What is CVE-2025-4981?

CVE-2025-4981 is a critical-severity vulnerability in Mattermost, classified under Uncontrolled Search Path Element. CVSS score: 9.9/10. Published 2025-06-20.

How severe is CVE-2025-4981?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Is CVE-2025-4981 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mattermost

CVE-2025-4981

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

EPSS: 0.007 (49.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Mattermost — versions 10.5.0, 9.11.0, 10.8.0
Mattermost Mattermost_server — versions 10.8.0

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

Public proof-of-concept exploits

kang9693/PoC_

References

responsibledisclosure@mattermost.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-4981?: CVE-2025-4981 is a critical-severity vulnerability in Mattermost, classified under Uncontrolled Search Path Element. CVSS score: 9.9/10. Published 2025-06-20.
How severe is CVE-2025-4981?: Critical severity. CVSS v3 base score is 9.9 out of 10.
Is CVE-2025-4981 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.