GHSA-gq3r-5833-5532
Mattermost Fails to Validate File Paths
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 10.9.0, < 10.9.2 | 10.9.2 |
| Go | github.com/mattermost/mattermost-server | >= 10.8.0, < 10.8.4 | 10.8.4 |
| Go | github.com/mattermost/mattermost-server | >= 10.5.0, < 10.5.9 | 10.5.9 |
| Go | github.com/mattermost/mattermost-server | >= 9.11.0, < 9.11.18 | 9.11.18 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250619095651-9dd0b3943e55 | 8.0.0-20250619095651-9dd0b3943e55 |
| Go | github.com/mattermost/mattermost-server/v5 | <= 5.11.1 | no fix listed |
| Go | github.com/mattermost/mattermost-server/v6 | <= 6.7.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
References
External links from the advisory. They lead to third-party sites.