GHSA-pj6f-rc94-gw53

ghsaUSosv

Mattermost Fails to Sanitize File Names

view advisory published 2025-08-21Licence: CC-BY-4.0

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-6465US	—	0.77% (55th)	—	2025-08-21
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-6465ADVISORY
https://pkg.go.dev/vuln/GO-2025-3906WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan