8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-9079

CVE-2025-9079: Mattermost Path Traversal vulnerability

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-9079

CVE-2025-9079:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.8.0, < 10.8.4	10.8.4
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.9	10.5.9
github.com/mattermost/mattermost-server	go	>= 9.11.0, < 9.11.18	9.11.18
github.com/mattermost/mattermost-server	go	>= 10.10.0, < 10.10.2	10.10.2
github.com/mattermost/mattermost-server	go	>= 10.9.0, < 10.9.4	10.9.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250707221302-a8fa77f107ef	8.0.0-20250707221302-a8fa77f107ef

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a path traversal that allows an administrator to execute arbitrary code by uploading a malicious plugin. The provided patches all point to a change in the onReceiveUploadCreate function within the sharedchannel service. At first glance, the patch, which validates the upload type, seems disconnected from a path traversal vulnerability related to plugin imports. However, the vulnerability description mentions a failure to validate the 'import directory path configuration' which allows for a 'malicious plugin upload'. The patch restricts uploads in shared channels to only be of type 'attachment'. This implies that other upload types were previously allowed, and one of these types was likely related to imports or plugins. The vulnerability is triggered by abusing the onReceiveUploadCreate function to initiate an upload of a malicious type. This, in conjunction with a separate path traversal flaw in the handling of that upload type, allows for the arbitrary file write. Therefore, onReceiveUploadCreate is the entry point for the exploit, making it a vulnerable function. The patch effectively closes this entry point in the context of shared channels.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.