GitHub Advisoryadvisory · Go

GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability

HIGH Published 2025-09-19 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-9079
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server, github.com/mattermost/mattermost/server/v8
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2025-09-19

Affected packages

• Go github.com/mattermost/mattermost-server: >= 10.8.0, < 10.8.4 → fixed in 10.8.4 • Go github.com/mattermost/mattermost-server: >= 10.5.0, < 10.5.9 → fixed in 10.5.9 • Go github.com/mattermost/mattermost-server: >= 9.11.0, < 9.11.18 → fixed in 9.11.18 • Go github.com/mattermost/mattermost-server: >= 10.10.0, < 10.10.2 → fixed in 10.10.2 • Go github.com/mattermost/mattermost-server: >= 10.9.0, < 10.9.4 → fixed in 10.9.4 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250707221302-a8fa77f107ef → fixed in 8.0.0-20250707221302-a8fa77f107ef

Description

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

Related

Alias · CVE (1)

  • CVE-2025-9079 Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References