CVE-2025-41395
published 2025-04-24CVE-2025-41395: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.46%
37.4th percentile
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-plugin-playbooks | >= 0 < 1.41.0 | 1.41.0 |
| github.com | mattermost_mattermost-plugin-playbooks | >= 2.0.0 | — |
| github.com | mattermost_mattermost-server | >= 10.4.0+incompatible | — |
| github.com | mattermost_mattermost-server | >= 10.5.0+incompatible | — |
| github.com | mattermost_mattermost-server | >= 9.11.0+incompatible | — |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
| github.com | mattermost_mattermost_server_v8 | >= 10.4.0 | — |
| github.com | mattermost_mattermost_server_v8 | >= 10.5.0 | — |
| github.com | mattermost_mattermost_server_v8 | >= 9.11.0 | — |
| mattermost | mattermost | — | — |
| mattermost | mattermost | 10.4.0 – 10.4.2 | — |
| mattermost | mattermost | 9.11.0 – 9.11.10 | — |
| mattermost | mattermost_server | >= 10.4.0 < 10.4.3 | 10.4.3 |
| mattermost | mattermost_server | >= 10.5.0 < 10.5.1 | 10.5.1 |
| mattermost | mattermost_server | >= 9.11.0 < 9.11.11 | 9.11.11 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
osv·2025-04-24
CVE-2025-41395 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: .
GHSA
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
ghsa·2025-04-24
CVE-2025-41395 [MEDIUM] CWE-1287 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
OSV
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
osv·2025-04-24
CVE-2025-41395 [MEDIUM] Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-24
Published