CVE-2025-47700

LOW

Mattermost Server 10.5.0-10.5.9 - Server-Side Request Forgery via Empty Request Body Handling

Title source: llm

Description

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates

Scores

CVSS v3 3.5

EPSS 0.0005

EPSS Percentile 15.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (3)

mattermost/mattermost 0 - 8.0.0-20250814075248-83a37a861d3cGo

mattermost/mattermost-server 10.5.0 - 10.5.10Go

mattermost/mattermost_server 10.5.0 - 10.5.9

Published Aug 21, 2025

Tracked Since Feb 18, 2026