~ / search / GHSA-qx3f-6vq3-8j8m

GHSA-qx3f-6vq3-8j8m

Mattermost Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-9079

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 10.8.0, < 10.8.4 10.8.4
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.9 10.5.9
Go github.com/mattermost/mattermost-server >= 9.11.0, < 9.11.18 9.11.18
Go github.com/mattermost/mattermost-server >= 10.10.0, < 10.10.2 10.10.2
Go github.com/mattermost/mattermost-server >= 10.9.0, < 10.9.4 10.9.4
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250707221302-a8fa77f107ef 8.0.0-20250707221302-a8fa77f107ef

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

References

External links from the advisory. They lead to third-party sites.