tocsin

Go/github.com/mattermost/mattermost-server CVE-2025-20051: medium 6.5, EPSS 0.61%

Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 9.11.8+incompatible or later.

go get github.com/mattermost/mattermost-server@v9.11.8+incompatible
go get github.com/mattermost/mattermost-server@v10.2.3+incompatible
go get github.com/mattermost/mattermost-server@v10.3.3+incompatible
go get github.com/mattermost/mattermost-server@v10.4.2+incompatible

Affected

introducedfixedlast affected
9.11.0-rc1+incompatible9.11.8+incompatible-
10.2.0-rc1+incompatible10.2.3+incompatible-
10.3.0-rc1+incompatible10.3.3+incompatible-
10.4.0-rc1+incompatible10.4.2+incompatible-

Fixed versions

9.11.8+incompatible10.2.3+incompatible10.3.3+incompatible10.4.2+incompatible

Sources

CVE-2025-20051 · published · modified · JSON