Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-20630 EUVD-2025-2180GHSA-93w4-x8jh-j7m2

Mobile crash via object that can't be cast to String in Attachment Field

Published Jan 16, 2025 · Updated Jan 16, 2025 · Assigned by Mattermost

Description

Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ <=2.22.0 2.23.0

References