CVE-2025-36530
Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
- Record
CVE-2025-36530- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2025-25421
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
- Record
EUVD-2025-25421- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gq3r-5833-5532
Mattermost Fails to Validate File Paths
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
- Record
GHSA-gq3r-5833-5532- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
- Record
CVE-2025-36530- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
- Record
CVE-2025-36530- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-07
OSVGHSA-gq3r-5833-5532
Mattermost Fails to Validate File Paths
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
- Record
GHSA-gq3r-5833-5532- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGO-2025-3901 No score
Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server
Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-20250619095651-9dd0b3943e55.
- Record
GO-2025-3901- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost-serverGo |
10.9.0 to 10.9.1 | 10.9.2 |
github.com/mattermost/mattermost-serverGo |
10.8.0 to 10.8.3 | 10.8.4 |
github.com/mattermost/mattermost-serverGo |
10.5.0 to 10.5.8 | 10.5.9 |
github.com/mattermost/mattermost-serverGo |
9.11.0 to 9.11.17 | 9.11.18 |
github.com/mattermost/mattermost/server/v8Go |
before 8.0.0-20250619095651-9dd0b3943e55 | 8.0.0-20250619095651-9dd0b3943e55 |
github.com/mattermost/mattermost-server/v5Go |
through 5.11.1 | None known |
github.com/mattermost/mattermost-server/v6Go |
through 6.7.2 | None known |
github.com/mattermost/mattermost-serverGo |
10.9.0 up to 10.9.2 | 10.9.2 |
github.com/mattermost/mattermost-serverGo |
10.8.0 up to 10.8.4 | 10.8.4 |
github.com/mattermost/mattermost-serverGo |
10.5.0 up to 10.5.9 | 10.5.9 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost-serverGo |
9.11.0 up to 9.11.18 | 9.11.18 |
github.com/mattermost/mattermost-serverGo |
9.11.0+incompatible up to 9.11.18+incompatible, 10.5.0+incompatible up to 10.5.9+incompatible, 10.8.0+incompatible up to 10.8.4+incompatible, 10.9.0+incompatible up to 10.9.2+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.2+incompatible |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
github.com/mattermost/mattermost/server/v8Go |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-36530 is a medium vulnerability (CVSS 6.8) in Mattermost, published August 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in github.com/mattermost/mattermost-server 10.9.2.