GHSA-qh58-9v3j-wcjc CVE-2025-4981 GO-2025-3769

Mattermost allows authenticated users to write files to arbitrary locations

Critical Go

Severity: 9.9 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 1.02%; Chance of exploitation in the next 30 days. Higher than 63.32% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-427 Uncontrolled Search Path Element
Fix: Available; 2 packages have a fixed version

Description

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/mattermost/mattermost-server	`< 0.0.0-20250519205859-65aec10162f6`	`0.0.0-20250519205859-65aec10162f6`
github.com/mattermost/mattermost-server	`< 0.0.0-20250519205859-65aec10162f6` `>= 9.11.0+incompatible, < 9.11.16+incompatible` `>= 10.5.0+incompatible, < 10.5.6+incompatible` `>= 10.6.0+incompatible, < 10.6.6+incompatible` `>= 10.7.0+incompatible, < 10.7.3+incompatible` `>= 10.8.0+incompatible, < 10.8.1+incompatible`	`0.0.0-20250519205859-65aec10162f6` `9.11.16+incompatible` `10.5.6+incompatible` `10.6.6+incompatible` `10.7.3+incompatible` `10.8.1+incompatible`
github.com/mattermost/mattermost-server/v5	`all versions`	No fix yet
github.com/mattermost/mattermost-server/v6	`all versions`	No fix yet
github.com/mattermost/mattermost/server/v8	`< 8.0.0-20250519205859-65aec10162f6`	`8.0.0-20250519205859-65aec10162f6`
github.com/mattermost/mattermost/server/v8	`>= 10.5.0, < 10.5.6`	`10.5.6`
github.com/mattermost/mattermost/server/v8	`>= 9.11.0, < 9.11.16`	`9.11.16`
github.com/mattermost/mattermost/server/v8	`>= 10.8.0, < 10.8.1`	`10.8.1`
github.com/mattermost/mattermost/server/v8	`>= 10.7.0, < 10.7.3`	`10.7.3`
github.com/mattermost/mattermost/server/v8	`>= 10.6.0, < 10.6.6`	`10.6.6`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/mattermost/mattermost-server Go → `0.0.0-20250519205859-65aec10162f6`

go

go get github.com/mattermost/mattermost-server@v0.0.0-20250519205859-65aec10162f6 && go mod tidy

github.com/mattermost/mattermost/server/v8 Go → `8.0.0-20250519205859-65aec10162f6`

go

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20250519205859-65aec10162f6 && go mod tidy

Severity breakdown

CVSS 3.1 9.9

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-427: Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

How to prevent it

Architecture and Design, Implementation: Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Implementation: When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Implementation: Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Implementation: Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
Implementation: Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.

References

Advisories

Packages

github.com/mattermost/mattermost

Timeline

Jun 20, 2025 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-xmfh-3ccg-c9fx Mattermost has an Incorrect Authorization issue	Low	Also affects github.com/mattermost/mattermost-server
GHSA-h998-hxxj-8q83 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation	Medium	Also affects github.com/mattermost/mattermost-server
GHSA-g5vr-6pgg-74qv Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint	Low	Also affects github.com/mattermost/mattermost-server
GHSA-jqgv-39mg-7c2r Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret	Medium	Also affects github.com/mattermost/mattermost-server
GHSA-mxq2-5jpg-7474 Mattermost doesn't validate channel ownership of an existing subscription before applying edits	Medium	Also affects github.com/mattermost/mattermost-server
GHSA-2g8v-grq3-hq2g Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler	Medium	Also affects github.com/mattermost/mattermost-server
GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints	High	Also affects github.com/mattermost/mattermost-server
GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations	Medium	Also affects github.com/mattermost/mattermost-server

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor