cbcvebase.
CVE-2025-6465
published 2025-08-21

CVE-2025-6465: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload…

medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

Affected

17 ranges
VendorProductVersion rangeFixed in
github.commattermost_mattermost-server>= 10.10.0 < 10.10.110.10.1
github.commattermost_mattermost-server>= 10.10.0+incompatible < 10.10.1+incompatible10.10.1+incompatible
github.commattermost_mattermost-server>= 10.5.0 < 10.5.910.5.9
github.commattermost_mattermost-server>= 10.5.0+incompatible < 10.5.9+incompatible10.5.9+incompatible
github.commattermost_mattermost-server>= 10.8.0 < 10.8.410.8.4
github.commattermost_mattermost-server>= 10.8.0+incompatible < 10.8.4+incompatible10.8.4+incompatible
github.commattermost_mattermost-server>= 10.9.0 < 10.9.410.9.4
github.commattermost_mattermost-server>= 10.9.0+incompatible < 10.9.4+incompatible10.9.4+incompatible
github.commattermost_mattermost_server_v8>= 0 < 8.0.0-20250708173752-d6b35c41f0ae58.0.0-20250708173752-d6b35c41f0ae5
mattermostmattermost
mattermostmattermost10.5.0 – 10.5.8
mattermostmattermost10.8.0 – 10.8.3
mattermostmattermost10.9.0 – 10.9.3
mattermostmattermost_server
mattermostmattermost_server>= 10.5.0 < 10.5.910.5.9
mattermostmattermost_server>= 10.8.0 < 10.8.410.8.4
mattermostmattermost_server>= 10.9.0 < 10.9.410.9.4