CVE-2025-36530

MEDIUM

Mattermost 9.11.0-9.11.17 10.5.0-10.5.8 10.8.0-10.8.3 10.9.0-10.9.1 - Authenticated Path Traversal via Plugin Import

Title source: llm

Description

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates

Scores

CVSS v3 6.8

EPSS 0.0009

EPSS Percentile 25.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (4)

mattermost/mattermost 0 - 8.0.0-20250619095651-9dd0b3943e55Go

mattermost/mattermost-server 0 (2 CPE variants)Go

mattermost/mattermost-server 10.9.0 - 10.9.2Go

mattermost/mattermost_server 9.11.0 - 9.11.18

Published Aug 21, 2025

Tracked Since Feb 18, 2026