CVE-2025-4981
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
- Record
CVE-2025-4981- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
EUVDEUVD-2025-28315
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
- Record
EUVD-2025-28315- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qh58-9v3j-wcjc
Mattermost allows authenticated users to write files to arbitrary locations
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
- Record
GHSA-qh58-9v3j-wcjc- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
NVD
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
- Record
CVE-2025-4981- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
OSV
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
- Record
CVE-2025-4981- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-07
OSVGHSA-qh58-9v3j-wcjc
Mattermost allows authenticated users to write files to arbitrary locations
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
- Record
GHSA-qh58-9v3j-wcjc- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
OSVGO-2025-3769 No score
Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server
Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server
- Record
GO-2025-3769- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score
govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost-serverGo |
before 0.0.0-20250519205859-65aec10162f6 | 0.0.0-20250519205859-65aec10162f6 |
github.com/mattermost/mattermost/server/v8Go |
before 8.0.0-20250519205859-65aec10162f6 | 8.0.0-20250519205859-65aec10162f6 |
github.com/mattermost/mattermost/server/v8Go |
10.5.0 to 10.5.5 | 10.5.6 |
github.com/mattermost/mattermost/server/v8Go |
9.11.0 to 9.11.15 | 9.11.16 |
github.com/mattermost/mattermost/server/v8Go |
10.8.0 to 10.8.0 | 10.8.1 |
github.com/mattermost/mattermost/server/v8Go |
10.7.0 to 10.7.2 | 10.7.3 |
github.com/mattermost/mattermost/server/v8Go |
10.6.0 to 10.6.5 | 10.6.6 |
github.com/mattermost/mattermost/server/v8Go |
10.5.0 up to 10.5.6 | 10.5.6 |
github.com/mattermost/mattermost/server/v8Go |
9.11.0 up to 9.11.16 | 9.11.16 |
github.com/mattermost/mattermost/server/v8Go |
10.8.0 up to 10.8.1 | 10.8.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go |
10.7.0 up to 10.7.3 | 10.7.3 |
github.com/mattermost/mattermost/server/v8Go |
10.6.0 up to 10.6.6 | 10.6.6 |
github.com/mattermost/mattermost-serverGo |
before 0.0.0-20250519205859-65aec10162f6, 9.11.0+incompatible up to 9.11.16+incompatible, 10.5.0+incompatible up to 10.5.6+incompatible, 10.6.0+incompatible up to 10.6.6+incompatible, 10.7.0+incompatible up to 10.7.3+incompatible, 10.8.0+incompatible up to 10.8.1+incompatible | 0.0.0-20250519205859-65aec10162f69.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 0.0.20250730T213748-1.1 | 0.0.20250730T213748-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-4981 is a critical vulnerability (CVSS 9.9) in Mattermost, published June 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in github.com/mattermost/mattermost-server 0.0.0-20250519205859-65aec10162f6.
References
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-4981
github.com/mattermost/mattermost/commit/65aec10162f612d98edf91cc66bf7e781868448b
Show 56 moreShow less
suse.com/security/cve/CVE-2024-44905