Every CVE Search/ Get API key

CVE-2025-41395

Webapp DoS via malicious retrospective post in Playbooks

6.5 MediumFix available

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.50%Up 0.5 points since Apr 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Webapp DoS via malicious retrospective post in Playbooks

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Record
CVE-2025-41395
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1287
Updated
2026-11-02
EUVDEUVD-2025-12104 6.5

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Record
EUVD-2025-12104
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-3g36-gf7c-75qw 6.5

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Record
GHSA-3g36-gf7c-75qw
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1287
Updated
2026-11-02
NVD 6.5

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Record
CVE-2025-41395
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1287
Updated
2026-11-02
OSV 6.5

Webapp DoS via malicious retrospective post in Playbooks

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Record
CVE-2025-41395
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1287
Updated
2026-11-02
OSVGHSA-3g36-gf7c-75qw 6.5

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

Record
GHSA-3g36-gf7c-75qw
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1287
Updated
2026-11-02
OSVGO-2025-3642 No score

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Record
GO-2025-3642
Updated
2026-11-02
OSVopenSUSE-SU-2025:15033-1 No score

govulncheck-vulndb-0.0.20250424T181457-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250424T181457-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15033-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/mattermost/mattermost-plugin-playbooks
Go
 2.0.0 up to 2.1.1
2.1.1
github.com/mattermost/mattermost/server/v8
Go
 before 8.0.0-20250218121836-2b5275d87136
8.0.0-20250218121836-2b5275d87136
github.com/mattermost/mattermost/server/v8
Go
 10.4.0 up to 10.4.3
10.4.3
github.com/mattermost/mattermost/server/v8
Go
 10.5.0 up to 10.5.1
10.5.1
github.com/mattermost/mattermost/server/v8
Go
 9.11.0 up to 9.11.11
9.11.11
github.com/mattermost/mattermost-plugin-playbooks
Go
 before 1.41.0
1.41.0
github.com/mattermost/mattermost-plugin-playbooks
Go
 2.0.0 and later None known
github.com/mattermost/mattermost/server/v8
Go
 10.4.0 and later None known
github.com/mattermost/mattermost/server/v8
Go
 10.5.0 and later None known
github.com/mattermost/mattermost/server/v8
Go
 9.11.0 and later None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
github.com/mattermost/mattermost-plugin-playbooks
Go
 All versions None known
github.com/mattermost/mattermost-server
Go
 9.11.0+incompatible and later None known
github.com/mattermost/mattermost-server
Go
 10.4.0+incompatible and later None known
github.com/mattermost/mattermost-server
Go
 10.5.0+incompatible and later None known
github.com/mattermost/mattermost-server/v5
Go
 All versions None known
github.com/mattermost/mattermost-server/v6
Go
 All versions None known
github.com/mattermost/mattermost/server/v8
Go
 All versions None known
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.0.20250424T181457-1.1
0.0.20250424T181457-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-41395 is a medium vulnerability (CVSS 6.5) in Mattermost, published April 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in github.com/mattermost/mattermost-plugin-playbooks 2.1.1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open