CVE-2025-9079CWE-22path-traversal

CVE-2025-9079

High · published September 20, 2025

CVSS v3.1
8.0
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00642 · 50.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-20T00:15Z
Affected products (5)
ProductVersionsFixed in
mattermost/mattermost_server≥ 9.11.0, < 9.11.189.11.18
mattermost/mattermost_server≥ 10.5.0, < 10.5.910.5.9
mattermost/mattermost_server≥ 10.8.0, < 10.8.410.8.4
mattermost/mattermost_server≥ 10.9.0, < 10.9.410.9.4
mattermost/mattermost_server≥ 10.10.0, < 10.10.210.10.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 19 SEP 19:22Z
    Admin RCE via prepackaged plugins by way of misconfigured imports directory
    cvelistv5