10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4981

CVE-2025-4981: Mattermost allows authenticated users to write files to arbitrary locations

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4981

CVE-2025-4981:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	< 0.0.0-20250519205859-65aec10162f6	0.0.0-20250519205859-65aec10162f6
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250519205859-65aec10162f6	8.0.0-20250519205859-65aec10162f6
github.com/mattermost/mattermost/server/v8	go	>= 10.5.0, <= 10.5.5	10.5.6
github.com/mattermost/mattermost/server/v8	go	>= 9.11.0, <= 9.11.15	9.11.16
github.com/mattermost/mattermost/server/v8	go	= 10.8.0	10.8.1
github.com/mattermost/mattermost/server/v8	go	>= 10.7.0, <= 10.7.2	10.7.3
github.com/mattermost/mattermost/server/v8	go	>= 10.6.0, <= 10.6.5	10.6.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the docextractor.(*archiveExtractor).Extract function in server/platform/services/docextractor/archive.go. The function extracts files from an archive, and prior to the patch, it did not properly sanitize the filenames from the archive. Specifically, the line destPath := filepath.Join(tmpDir, f.Name()) is the culprit. An attacker could upload a specially crafted archive containing filenames with path traversal sequences (e.g., ../../some/path/file.txt). When this archive is processed, the Extract function would join the temporary directory path with the malicious filename, allowing the attacker to write a file outside of the intended temporary directory. This could lead to remote code execution if the attacker can overwrite a critical file. The fix involves sanitizing the filename using filepath.Base(f.Name()) before joining it with the temporary directory path. This ensures that any directory traversal sequences are stripped from the filename, mitigating the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.