CVE-2025-4981
Path Traversal Leading to RCE by Any Authenticated Mattermost User
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
Reserved 2025-05-20 | Published 2025-06-20 | Updated 2025-06-20 | Assigner MattermostCWE-427: Uncontrolled Search Path Element
Dawid Kulikowski (daw10)
mattermost.com/security-updates
Support options
