Mattermost <=10.5.5, <=9.11.15, <=10.8.0, <=10.7.2, <=10.6.5 - Authenticated Arbitrary File Write via Path Traversal
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-4981. PoCs published by exploitintel.
AI-analyzed exploit summary This repository contains functional exploit code demonstrating CVE-2025-4981, a path traversal vulnerability in Mattermost Server's Upload Session API. The PoC scripts exploit the lack of filename sanitization in the archive extractor to achieve arbitrary file write, with potential for RCE.
Description
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
Exploits (1)
This repository contains functional exploit code demonstrating CVE-2025-4981, a path traversal vulnerability in Mattermost Server's Upload Session API. The PoC scripts exploit the lack of filename sanitization in the archive extractor to achieve arbitrary file write, with potential for RCE.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
