NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2025-4981: Mattermost allows authenticated users to write files to arbitrary locations

criticalCVSS 3.1 9.9GHSA-qh58-9v3j-wcjc

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution.

Published Jun 20, 2025

Affected packages

github.com/mattermost/mattermost-server

Ecosystem
Go
Affected
< 0.0.0-20250519205859-65aec10162f6
Fixed in
0.0.0-20250519205859-65aec10162f6
Check
go list -m github.com/mattermost/mattermost-server

github.com/mattermost/mattermost/server/v8

Ecosystem
Go
Affected
< 8.0.0-20250519205859-65aec10162f6
Fixed in
8.0.0-20250519205859-65aec10162f6
Check
go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem
Go
Affected
>= 10.5.0, <= 10.5.5
Fixed in
10.5.6
Check
go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem
Go
Affected
>= 9.11.0, <= 9.11.15
Fixed in
9.11.16
Check
go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem
Go
Affected
= 10.8.0
Fixed in
10.8.1
Check
go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem
Go
Affected
>= 10.7.0, <= 10.7.2
Fixed in
10.7.3
Check
go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem
Go
Affected
>= 10.6.0, <= 10.6.5
Fixed in
10.6.6
Check
go list -m github.com/mattermost/mattermost/server/v8

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries