CVE-2025-6233: Arbitrary file read by system admin via path traversal
Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.0.0-20250529054450-d38c27f96fcf - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 9.11.17 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.5.8 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.7.4 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.8.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.9.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.8.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.7.4 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.5.8 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 9.11.17
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6233?
CVE-2025-6233 has a severity rating that indicates it poses a significant risk due to the potential for unauthorized access to sensitive system files.
How do I fix CVE-2025-6233?
To address CVE-2025-6233, upgrade to Mattermost versions 10.8.2, 10.7.4, 10.5.8, or 9.11.17 or later, which include the necessary vulnerability mitigations.
What types of files can be accessed due to CVE-2025-6233?
CVE-2025-6233 allows arbitrary access to system files through path traversal, potentially exposing sensitive data.
Who is affected by CVE-2025-6233?
CVE-2025-6233 affects Mattermost versions 10.8.x, 10.7.x, 10.5.x, and 9.11.x that are below specific patch levels.
What is the exploit mechanism of CVE-2025-6233?
CVE-2025-6233 exploits a failure to properly sanitize input paths of file attachments in the bulk import JSONL file.