CVE-2025-31363
Data exfiltration via AI plugin Jira tool
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Data exfiltration via AI plugin Jira tool
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Record
CVE-2025-31363- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-1426
- Updated
- 2026-11-02
EUVDEUVD-2025-11357
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Record
EUVD-2025-11357- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9h6j-4ffx-cm84
Mattermost doesn't restrict domains LLM can request to contact upstream
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Record
GHSA-9h6j-4ffx-cm84- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-201, CWE-497
- Updated
- 2026-11-02
NVD
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Record
CVE-2025-31363- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
Data exfiltration via AI plugin Jira tool
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Record
CVE-2025-31363- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-1426
- Updated
- 2026-11-02
OSVGHSA-9h6j-4ffx-cm84
Mattermost doesn't restrict domains LLM can request to contact upstream
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Record
GHSA-9h6j-4ffx-cm84- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-201, CWE-497
- Updated
- 2026-11-02
OSVGO-2025-3622 No score
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
- Record
GO-2025-3622- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15017-1 No score
govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250422T181640-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15017-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go |
10.5.0 up to 10.5.1 | 10.5.1 |
github.com/mattermost/mattermost/server/v8Go |
10.4.0 up to 10.4.3 | 10.4.3 |
github.com/mattermost/mattermost/server/v8Go |
9.11.0 up to 9.11.10 | 9.11.10 |
github.com/mattermost/mattermost/server/v8Go |
before 8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
github.com/mattermost/mattermost-serverGo |
9.11.0+incompatible up to 9.11.10+incompatible, 10.4.0+incompatible up to 10.4.3+incompatible, 10.5.0+incompatible up to 10.5.1+incompatible | 9.11.10+incompatible10.4.3+incompatible10.5.1+incompatible |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 23 CVEs |
before 0.0.20250422T181640-1.1 | 0.0.20250422T181640-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31363 is a low vulnerability (CVSS 3.0) in Mattermost, published April 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in github.com/mattermost/mattermost/server/v8 10.5.1.
References
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-31363
pkg.go.dev/vuln/GO-2025-3622
github.com/advisories/GHSA-9h6j-4ffx-cm84
Show 24 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7
suse.com/security/cve/CVE-2019-15119