{"cve":"CVE-2025-4981","nvd":{"published":"2025-06-20T11:15:20.993","modified":"2026-06-17T09:34:26.060","status":"Analyzed","description":"Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},"cwes":["CWE-427"],"references":["https://mattermost.com/security-updates"],"products":["mattermost:mattermost_server"],"source":"nvd","synced_at":"2026-10-19T22:03:23.287444849+00:00"},"epss":{"cve":"CVE-2025-4981","score":0.01016,"percentile":0.63323,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qh58-9v3j-wcjc","url":"https://osv.dev/vulnerability/GHSA-qh58-9v3j-wcjc","summary":"Mattermost allows authenticated users to write files to arbitrary locations","modified":"2025-07-28T20:42:05.354742Z","packages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":["<0.0.0-20250519205859-65aec10162f6"],"fixed":["0.0.0-20250519205859-65aec10162f6"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":["<8.0.0-20250519205859-65aec10162f6"],"fixed":["8.0.0-20250519205859-65aec10162f6"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":[">=10.5.0 <10.5.6"],"fixed":["10.5.6"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":[">=9.11.0 <9.11.16"],"fixed":["9.11.16"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":[">=10.8.0 <10.8.1"],"fixed":["10.8.1"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":[">=10.7.0 <10.7.3"],"fixed":["10.7.3"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":[">=10.6.0 <10.6.6"],"fixed":["10.6.6"]}]},{"id":"GO-2025-3769","url":"https://osv.dev/vulnerability/GO-2025-3769","summary":"Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server","modified":"2026-03-03T04:57:20.146437Z","packages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":["<0.0.0-20250519205859-65aec10162f6",">=9.11.0+incompatible <9.11.16+incompatible",">=10.5.0+incompatible <10.5.6+incompatible",">=10.6.0+incompatible <10.6.6+incompatible",">=10.7.0+incompatible <10.7.3+incompatible",">=10.8.0+incompatible <10.8.1+incompatible"],"fixed":["0.0.0-20250519205859-65aec10162f6","9.11.16+incompatible","10.5.6+incompatible","10.6.6+incompatible","10.7.3+incompatible","10.8.1+incompatible"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v5","purl":"pkg:golang/github.com/mattermost/mattermost-server/v5","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v6","purl":"pkg:golang/github.com/mattermost/mattermost-server/v6","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":["<8.0.0-20250519205859-65aec10162f6"],"fixed":["8.0.0-20250519205859-65aec10162f6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}