Skip to content
OpenAdvisories
Medium · 6.8 CVE-2025-36530 EUVD-2025-25421GHSA-gq3r-5833-5532GO-2025-3901

Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

Published Aug 21, 2025 · Updated Aug 21, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 10.9.0 – ≤ 10.9.1, 10.8.0 – ≤ 10.8.3, 10.5.0 – ≤ 10.5.8, 9.11.0 – ≤ 9.11.17 10.10.0

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server >= 10.9.0, < 10.9.2 10.9.2 GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost-server >= 10.8.0, < 10.8.4 10.8.4 GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.9 10.5.9 GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost-server >= 9.11.0, < 9.11.18 9.11.18 GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost-server >= 9.11.0+incompatible, < 9.11.18+incompatible · >= 10.5.0+incompatible, < 10.5.9+incompatible · >= 10.8.0+incompatible, < 10.8.4+incompatible · >= 10.9.0+incompatible, < 10.9.2+incompatible 9.11.18+incompatible, 10.5.9+incompatible, 10.8.4+incompatible, 10.9.2+incompatible GO-2025-3901
Go github.com/mattermost/mattermost-server/v5 <= 5.11.1 — GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2025-3901
Go github.com/mattermost/mattermost-server/v6 <= 6.7.2 — GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2025-3901
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250619095651-9dd0b3943e55 8.0.0-20250619095651-9dd0b3943e55 GHSA-gq3r-5833-5532
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2025-3901

Advisories 1

References