~ / search / GHSA-v469-7wp6-7cvp

GHSA-v469-7wp6-7cvp

Mattermost allows reading arbitrary files

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-20051

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e 8.0.0-20250122165010-4ed702ccff4e
Go github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8 9.11.8
Go github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3 10.2.3
Go github.com/mattermost/mattermost/server/v8 >= 10.3.0-rc1, < 10.3.3 10.3.3
Go github.com/mattermost/mattermost/server/v8 >= 10.4.0-rc1, < 10.4.2 10.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.

References

External links from the advisory. They lead to third-party sites.