GHSA-vqwh-5jhh-vc9p
Mattermost Server SSRF Vulnerability via the Agents Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 10.5.0, < 10.5.10 | 10.5.10 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250814075248-83a37a861d3c | 8.0.0-20250814075248-83a37a861d3c |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions
References
External links from the advisory. They lead to third-party sites.