CVE-2025-4981

🎯 CVE-2025-4981 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2025-4981 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (Fi

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

Klassifikation & Betroffenheit:

CWE-427 Mattermost Mattermost 10.5.0 ≤10.5.5Mattermost 9.11.0 ≤9.11.15Mattermost 10.8.0 ≤10.8.0MattermostMattermost 10.6.0 ≤10.6.5Mattermost 10.7.0 ≤10.7.2mattermost mattermost_server *mattermost mattermost_server 10.8.0

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

🛡️ Empfohlene Mitigation: Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-38 · Leveraging/Manipulating Configuration Fi… (Very High) CAPEC-471 · Search Order Hijacking (Medium)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1574.007 · Hijack Execution Flow: Path Interc… T1574.009 · Hijack Execution Flow: Path Interc… T1574.001 · Hijack Execution Flow:DLL search o… T1574.004 · Hijack Execution Flow: Dylib Hijac… T1574.008 · Hijack Execution Flow: Path Interc…

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-40342 10.0 CVE-2025-12421 9.9 CVE-2025-12419 9.9 CVE-2025-20051 9.9 CVE-2025-25279 9.9

🩹 Patch verfügbar (OSV):

🩹 96fdd2b677f28d1375df8dfa88bbc519f32bb3b6 (Commit) 🩹 2c4a9f9d49d9a6aa94b073e8871ff67e95f8984e (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 mattermost.com/security-updates

Ausnutzungs-Zeitleiste:

Reserviert 2025

Veröffentlicht 06/2025

Heute 09.11.

CVSS-Vektor-Analyse: 9.9

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CNA-Bewertung (Mattermost): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Veröffentlicht:20.06.2025

Aktualisiert:17.06.2026 09:34

Assigner (CNA):Mattermost

EUVD-ID:EUVD-2025-28315

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-427 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.142	3,2 %
<10 %	396.069	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.142

3,2 %

<10 %

396.069

95,8 %

CVE-2025-4981 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (Fi

Mattermost versions 10.5.x

CWE-427 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Zero-Day & Vulnerability Intelligence Hub