tocsin

Go/github.com/mattermost/mattermost-server CVE-2025-4981: critical 9.9, EPSS 1.02%

Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 0.0.0-20250519205859-65aec10162f6 or later.

go get github.com/mattermost/mattermost-server@v0.0.0-20250519205859-65aec10162f6
go get github.com/mattermost/mattermost-server@v9.11.16+incompatible
go get github.com/mattermost/mattermost-server@v10.5.6+incompatible
go get github.com/mattermost/mattermost-server@v10.6.6+incompatible
go get github.com/mattermost/mattermost-server@v10.7.3+incompatible
go get github.com/mattermost/mattermost-server@v10.8.1+incompatible

Affected

introducedfixedlast affected
09.11.16+incompatible-
10.5.0+incompatible10.5.6+incompatible-
10.6.0+incompatible10.6.6+incompatible-
10.7.0+incompatible10.7.3+incompatible-
10.8.0+incompatible10.8.1+incompatible-

Fixed versions

0.0.0-20250519205859-65aec10162f69.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible

Sources

CVE-2025-4981 · published · modified · JSON