CVE-2025-21088: Mattermost Incorrect Type Conversion or Cast
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.27181%
CWE
Published
1/15/2025
Updated
1/17/2025
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 10.2.0, < 10.2.1 | 10.2.1 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.1.0, <= 10.1.3 | 10.1.4 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.0.0, <= 10.0.3 | 10.0.4 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.11.0, <= 9.11.5 | 9.11.6 |
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20241127161322-25ff7a3779a5 | 8.0.0-20241127161322-25ff7a3779a5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper type validation in post.props.attachments processing. Based on the CWE-704 description and Mattermost's architecture:
- PostAction unmarshalling is a prime candidate as it directly handles user-controlled input
- Attachment processing functions would be responsible for validating action styles
- The frontend crash suggests type safety failures in data serialization
- Confidence is medium due to lack of direct patch/diff evidence, but these are logical locations based on the described attack vector and component structure