CVE-2025-47700CWE-918

AI plugin APIs can be triggered using post actions

Low · published August 21, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-08-21T07:28Z
EPSS history
Timeline
  • 21 AUG 07:28Z
    AI plugin APIs can be triggered using post actions
    cvelistv5