{"id":"CVE-2025-25279","aliases":["GHSA-5fwx-p6xh-vjrh","GO-2025-3480"],"title":"Mattermost allows reading arbitrary files related to importing boards","summary":"Mattermost allows reading arbitrary files related to importing boards","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"mattermost","product":"github.com/mattermost/mattermost/server/v8","ecosystem":"go","affected":["github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e","github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8","github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3","github.com/mattermost/mattermost/server/v8 >= 10.3.0-rc1, < 10.3.3","github.com/mattermost/mattermost/server/v8 >= 10.4.0-rc1, < 10.4.2"],"patched":["github.com/mattermost/mattermost/server/v8 8.0.0-20250122165010-4ed702ccff4e","github.com/mattermost/mattermost/server/v8 9.11.8","github.com/mattermost/mattermost/server/v8 10.2.3","github.com/mattermost/mattermost/server/v8 10.3.3","github.com/mattermost/mattermost/server/v8 10.4.2"],"published":"2025-02-24","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:22.367474853Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5fwx-p6xh-vjrh","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25279"},{"url":"https://github.com/mattermost/mattermost-plugin-boards/commit/025ce8d363a054473bc002f43f602a4032d38c06"},{"url":"https://github.com/mattermost/mattermost/commit/4ed702ccff4ec3c9eff832a9b6060f9f4454141d"},{"url":"https://github.com/mattermost/mattermost"},{"url":"https://mattermost.com/security-updates"}],"tags":["osv","go","exploit-available"],"epss":0.24041,"epssPercentile":0.97769,"exploits":{"github":2,"githubRepos":["https://github.com/numanturle/CVE-2025-25279","https://github.com/AbokorMAHAMMADMOUSSE/CVE-2025-25279-Mattermost-Path-Traversal"],"checkedAt":"2026-09-27T10:33:33.717Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.755Z","slug":"CVE-2025-25279","body":"## Overview\n\nMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.\n\n## Affected packages\n\n- `github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e`\n- `github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8`\n- `github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3`\n- `github.com/mattermost/mattermost/server/v8 >= 10.3.0-rc1, < 10.3.3`\n- `github.com/mattermost/mattermost/server/v8 >= 10.4.0-rc1, < 10.4.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/mattermost/mattermost/server/v8 8.0.0-20250122165010-4ed702ccff4e`\n- `github.com/mattermost/mattermost/server/v8 9.11.8`\n- `github.com/mattermost/mattermost/server/v8 10.2.3`\n- `github.com/mattermost/mattermost/server/v8 10.3.3`\n- `github.com/mattermost/mattermost/server/v8 10.4.2`","depth":"abyssal","depthScore":71,"depthScoreParts":{"impact":54.5,"likelihood":4.8,"exploitation":12,"ransomware":0},"changes":[]}