6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-36530

CVE-2025-36530: Mattermost Fails to Validate File Paths

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-36530

CVE-2025-36530:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.9.0, <= 10.9.1	10.9.2
github.com/mattermost/mattermost-server	go	>= 10.8.0, <= 10.8.3	10.8.4
github.com/mattermost/mattermost-server	go	>= 10.5.0, <= 10.5.8	10.5.9
github.com/mattermost/mattermost-server	go	>= 9.11.0, <= 9.11.17	9.11.18
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250619095651-9dd0b3943e55	8.0.0-20250619095651-9dd0b3943e55

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper validation of file paths during plugin import operations, which allows for path traversal. By analyzing the provided security patches, I was able to pinpoint the exact function that was modified to address this issue. The commit 9dd0b3943e5547e3386d47e84aa18d3c6bac84cf introduces a check in the uploadRemoteData function within server/channels/api4/remote_cluster.go to explicitly block uploads of type import. This indicates that this function was the entry point for the vulnerability. The patch effectively mitigates the issue by preventing the use of this function for importing plugins, thus closing the path traversal loophole. The evidence from the patch, combined with the vulnerability description, provides a high-confidence assessment of the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.