CVE-2025-6465: Mattermost Fails to Sanitize File Names
4.3
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | >= 10.8.0, <= 10.8.3 | 10.8.4 |
| github.com/mattermost/mattermost-server | go | >= 10.5.0, <= 10.5.8 | 10.5.9 |
| github.com/mattermost/mattermost-server | go | >= 10.9.0, <= 10.9.3 | 10.9.4 |
| github.com/mattermost/mattermost-server | go | = 10.10.0 | 10.10.1 |
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250708173752-d6b35c41f0ae5 | 8.0.0-20250708173752-d6b35c41f0ae5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability described is a path traversal issue in Mattermost's file upload functionality. By analyzing the provided patch, I identified the exact location of the fix. The commit d6b35c41f0ae5 directly addresses the vulnerability. The key change is in the server/channels/api4/upload.go file, within the createUpload function. The addition of us.Filename = filepath.Base(us.Filename) sanitizes the user-provided filename by stripping any directory information, thus mitigating the path traversal attack. The corresponding test file, server/channels/api4/upload_test.go, confirms this by adding a test case that attempts to use a malicious filename (../../../image.png) and asserts that it gets cleaned to image.png. Therefore, the createUpload function is the vulnerable function, as it was the entry point for processing the malicious file upload request.