6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49222

CVE-2025-49222: Mattermost Fails to Validate Remote Cluster Upload Sessions

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions which allows a system admin to upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49222

CVE-2025-49222:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.8.0, <= 10.8.3	10.8.4
github.com/mattermost/mattermost-server	go	>= 10.5.0, <= 10.5.8	10.5.9
github.com/mattermost/mattermost-server	go	>= 9.11.0, <= 9.11.17	9.11.18
github.com/mattermost/mattermost-server	go	>= 10.9.0, <= 10.9.2	10.9.3
github.com/mattermost/mattermost-server	go	= 10.10.0	10.10.1
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250708173752-d6b35c41f0ae5	8.0.0-20250708173752-d6b35c41f0ae5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a combination of two weaknesses in Mattermost's file upload process for remote clusters. First, the sharedchannel.Service.onReceiveUploadCreate function failed to validate the type of upload, allowing a system administrator to initiate an upload of a file that is not an attachment. Second, the api4.createUpload function did not properly sanitize the filename, making it vulnerable to path traversal. An attacker with system admin privileges could exploit these two vulnerabilities in concert. By creating a remote upload session with a malicious filename containing path traversal sequences (e.g., ../..//tmp/pwned.txt) and a non-attachment upload type, the attacker could write a file to an arbitrary location on the Mattermost server's filesystem. The patches address these issues by adding the necessary validation and sanitization. The first patch ensures that only attachments can be uploaded through shared channels, and the second patch cleans the filename to prevent path traversal.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.