CVE-2025-9079 - Vulnerability Details - OpenCVE

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

Update Mattermost to versions 10.11.0, 10.8.4, 10.5.9, 9.11.18, 10.10.2, 10.9.4 or higher.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://mattermost.com/security-updates

History

Fri, 19 Sep 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 19 Sep 2025 19:30:00 +0000

Type	Values Removed	Values Added
Description		Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory
Title		Admin RCE via prepackaged plugins by way of misconfigured imports directory
Weaknesses		CWE-22
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2025-09-19T19:22:00.288Z

Updated: 2025-09-19T19:45:22.181Z

Reserved: 2025-08-15T15:42:04.648Z

Link: CVE-2025-9079

Vulnrichment

Updated: 2025-09-19T19:45:14.408Z

NVD

Status : Received

Published: 2025-09-19T20:15:40.540

Modified: 2025-09-19T20:15:40.540

Link: CVE-2025-9079

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9079", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-08-15T15:42:04.648Z", "datePublished": "2025-09-19T19:22:00.288Z", "dateUpdated": "2025-09-19T19:45:22.181Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.8.3", "status": "affected", "version": "10.8.0", "versionType": "semver"}, {"lessThanOrEqual": "10.5.8", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"lessThanOrEqual": "9.11.17", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"lessThanOrEqual": "10.10.1", "status": "affected", "version": "10.10.0", "versionType": "semver"}, {"lessThanOrEqual": "10.9.3", "status": "affected", "version": "10.9.0", "versionType": "semver"}, {"version": "10.11.0", "status": "unaffected"}, {"version": "10.8.4", "status": "unaffected"}, {"version": "10.5.9", "status": "unaffected"}, {"version": "9.11.18", "status": "unaffected"}, {"version": "10.10.2", "status": "unaffected"}, {"version": "10.9.4", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "daw10"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseSeverity": "HIGH", "baseScore": 8}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22"}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"value": "Update Mattermost to versions 10.11.0, 10.8.4, 10.5.9, 9.11.18, 10.10.2, 10.9.4 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2025-00503", "defect": ["https://mattermost.atlassian.net/browse/MM-64674"], "discovery": "EXTERNAL"}, "title": "Admin RCE via prepackaged plugins by way of misconfigured imports directory", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-09-19T19:22:00.288Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-19T19:45:08.834479Z", "id": "CVE-2025-9079", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T19:45:22.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-19T19:45:08.834479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T19:45:14.408Z"}}], "cna": {"title": "Admin RCE via prepackaged plugins by way of misconfigured imports directory", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-64674"], "advisory": "MMSA-2025-00503", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "daw10"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.8.0", "versionType": "semver", "lessThanOrEqual": "10.8.3"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.8"}, {"status": "affected", "version": "9.11.0", "versionType": "semver", "lessThanOrEqual": "9.11.17"}, {"status": "affected", "version": "10.10.0", "versionType": "semver", "lessThanOrEqual": "10.10.1"}, {"status": "affected", "version": "10.9.0", "versionType": "semver", "lessThanOrEqual": "10.9.3"}, {"status": "unaffected", "version": "10.11.0"}, {"status": "unaffected", "version": "10.8.4"}, {"status": "unaffected", "version": "10.5.9"}, {"status": "unaffected", "version": "9.11.18"}, {"status": "unaffected", "version": "10.10.2"}, {"status": "unaffected", "version": "10.9.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.11.0, 10.8.4, 10.5.9, 9.11.18, 10.10.2, 10.9.4 or higher."}], "references": [{"url": "https://mattermost.com/security-updates"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-09-19T19:22:00.288Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9079", "state": "PUBLISHED", "dateUpdated": "2025-09-19T19:45:22.181Z", "dateReserved": "2025-08-15T15:42:04.648Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-09-19T19:22:00.288Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}