CVSS 3.1
3.5 lowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NCVE-2025-47700
Low (3.5) in mattermost mattermost server. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-server 10.5.10, 10.5.10+incompatible.
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vqwh-5jhh-vc9p | Go | github.com/mattermost/mattermost-server | >=10.5.0 <10.5.10 | 10.5.10 |
| GHSA-vqwh-5jhh-vc9p | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250814075248-83a37a861d3c | 8.0.0-20250814075248-83a37a861d3c |
| GO-2025-3906 | Go | github.com/mattermost/mattermost-server | >=10.5.0+incompatible <10.5.10+incompatible | 10.5.10+incompatible |
| GO-2025-3906 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2025-3906 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2025-3906 | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250814075248-83a37a861d3c | 8.0.0-20250814075248-83a37a861d3c |