CVE-2025-62690CWE-601
CVE-2025-62690
Low · published December 17, 2025
What it is
Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.
The record
Technical detail
- CVSS v3.1
- 3.1 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00149 · 3.7th percentile
- Weakness
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
- Published
- 2025-12-17T18:15Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| mattermost/mattermost_server | ≥ 10.11.0, < 10.11.5 | 10.11.5 |
References (1)
EPSS history
Timeline