CVE-2025-25279

Published Feb 24, 2025

Last updated a month ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-25279 is a vulnerability in Mattermost Boards, a plugin for the Mattermost team communication platform. It involves improper validation of board blocks during import and export operations. By crafting a malicious import archive, an attacker can exploit this flaw to read arbitrary files on the server's file system. This vulnerability affects Mattermost versions 10.4.x up to 10.4.1, 9.11.x up to 9.11.7, 10.3.x up to 10.3.2, and 10.2.x up to 10.2.2, specifically those with the Boards feature enabled. Exploitation allows an attacker to potentially access sensitive data such as configuration files and system credentials. Patches are available, and it is recommended to update to the latest Mattermost version to mitigate this vulnerability.

Description: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.
Source: responsibledisclosure@mattermost.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

responsibledisclosure@mattermost.com: CWE-22

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References