CVE-2025-6233: Mattermost Server

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.

Affected products

• Mattermost Mattermost Server: from 9.11.0, before 9.11.17 (fixed in 9.11.17); from 10.5.0, before 10.5.8 (fixed in 10.5.8); from 10.7.0, before 10.7.4 (fixed in 10.7.4); from 10.8.0, before 10.8.2 (fixed in 10.8.2)

Published 2025-07-18. Last modified 2026-06-17.