CVE-2025-62690
Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.
- CVSS 3.1
- 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-25)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q66g-q98c-q454 | Go | github.com/mattermost/mattermost/server/v8 | >=8.0.0-20250721062209-4952acea88ce <8.0.0-20251016131338-dad6bd7a1509 | 8.0.0-20251016131338-dad6bd7a1509 |
| GHSA-q66g-q98c-q454 | Go | github.com/mattermost/mattermost | >=10.11.0-rc1 <10.11.5-0.20251016131338-dad6bd7a1509 | 10.11.5-0.20251016131338-dad6bd7a1509 |
| GHSA-q66g-q98c-q454 | Go | github.com/mattermost/mattermost | >=11.0.0-alpha.1 <11.1.0 | 11.1.0 |
| GO-2025-4248 | Go | github.com/mattermost/mattermost | >=10.11.0-rc1+incompatible <11.1.0+incompatible | 11.1.0+incompatible |
| GO-2025-4248 | Go | github.com/mattermost/mattermost-server | all versions | no fix published |
| GO-2025-4248 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2025-4248 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2025-4248 | Go | github.com/mattermost/mattermost/server/v8 | >=8.0.0-20250721062209-4952acea88ce <8.0.0-20251016131338-dad6bd7a1509 | 8.0.0-20251016131338-dad6bd7a1509 |