Upstream information
Description
Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having moderate severity.
CNA (Mattermost) | |
---|---|
Base Score | 6.8 |
Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | High |
User Interaction | None |
Scope | Changed |
Confidentiality Impact | High |
Integrity Impact | None |
Availability Impact | None |
CVSSv3 Version | 3.1 |
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2025-15405 |
SUSE Timeline for this CVE
CVE page created: Fri Jul 18 14:00:16 2025CVE page last modified: Tue Aug 5 01:24:14 2025