CVE-2025-4981

moderate-risk
Published 2025-06-20

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

Do I need to act?

-
0.63% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 96fdd2b677f28d1375df8dfa88bbc519f32bb3b6, 2c4a9f9d49d9a6aa94b073e8871ff67e95f8984e, 303cb88e93f0426657feb473b323d9e22dc0e43c, 5521da96cf8e84ff3f249ff0e3599d131c05e850
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Mattermost

References (1)

Vendor Advisory https://mattermost.com/security-updates
47
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 2/34 · Minimal
Exposure 12/34 · Low