216.73.217.22

CVE-2025-49222

· Published 21/08/2025 08:15 · Modified 21/08/2025 08:15

Labels: CVE-2025-49222 2025-08-21CVE-2025-49222CWE-434[email protected]

Essential information

Published
21/08/2025 08:15
Modified
21/08/2025 08:15
Author
—
Creator
—
CVSS
6.8 MEDIUM (v3.1)
CISA KEV
No
CWE
—
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CVSS metrics

Description

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions which allows a system admin to upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
mattermost / mattermost cpe:2.3:a:mattermost:mattermost:10.8.0-10.8.3:*:*:*:*:*:*:*
mattermost / mattermost cpe:2.3:a:mattermost:mattermost:10.5.0-10.5.8:*:*:*:*:*:*:*
mattermost / mattermost cpe:2.3:a:mattermost:mattermost:9.11.0-9.11.17:*:*:*:*:*:*:*
mattermost / mattermost cpe:2.3:a:mattermost:mattermost:10.9.0-10.9.2:*:*:*:*:*:*:*
mattermost / mattermost cpe:2.3:a:mattermost:mattermost:10.10.0:*:*:*:*:*:*:*

References