What is CVE-2025-36530?

CVE-2025-36530 is a medium-severity vulnerability in Mattermost, classified under Path Traversal. CVSS score: 6.8/10. Published 2025-08-21.

How severe is CVE-2025-36530?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Path Traversal in Mattermost

CVE-2025-36530

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.005 (39.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.

Affected products

Mattermost — versions 10.9.0, 10.8.0, 10.5.0
Mattermost Mattermost_server

Weakness classification (CWE)

CWE-22 — Path Traversal

References

responsibledisclosure@mattermost.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-36530?: CVE-2025-36530 is a medium-severity vulnerability in Mattermost, classified under Path Traversal. CVSS score: 6.8/10. Published 2025-08-21.
How severe is CVE-2025-36530?: Medium severity. CVSS v3 base score is 6.8 out of 10.