CVE-2025-20621

highpriority · track · 30EPSS 0.005 · 41 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.48% (41st) EPSS
CVSS 7.5 · high
Is it mine?
19 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedgovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedgovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · responsibledisclosure@mattermost.comexploitability 2.8 · impact 3.6
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1287USCWE-1287US
05

affected products (19)

Products and version ranges known to be affected.

06

advisories (3)

Vendor and ecosystem advisories describing this.

  • SUSE-SU-2025:0297-1Security update for govulncheck-vulndb2025-01-30csaf · suse_csafDE

    Security update for govulncheck-vulndb

  • GHSA-w6xh-c82w-h997Mattermost webapp crash via a crafted post2025-01-16ghsa · osvUS

    Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.

  • GO-2025-3407Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server2025-01-17vendor · osvUS

    Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server

07

also known as (5)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvnvdsuse_csafNVDCVE.orgMITRE
published 2025-01-16modified 2026-06-17
09

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan