CVE-2025-4981: Path Traversal Leading to RCE by Any Authenticated Mattermost User
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4981?
CVE-2025-4981 is considered a high-severity vulnerability due to its ability to allow authenticated users to write files to arbitrary locations on the filesystem.
How do I fix CVE-2025-4981?
To fix CVE-2025-4981, upgrade to Mattermost version 10.6.6, 10.7.3, 10.8.1, or 9.11.16 or any version beyond the affected ones.
Who is affected by CVE-2025-4981?
CVE-2025-4981 affects Mattermost versions 10.5.x through 10.5.5, 9.11.x through 9.11.15, 10.8.x through 10.8.0, 10.7.x through 10.7.2, and 10.6.x through 10.6.5.
What is the impact of CVE-2025-4981?
The impact of CVE-2025-4981 includes unauthorized file uploads that could compromise the security of the Mattermost installation.
Is there a workaround for CVE-2025-4981?
There are currently no known workarounds for CVE-2025-4981, so upgrading to a fixed version is recommended.