Description
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 11.3.0 – ≤ 11.3.0, 11.2.0 – ≤ 11.2.2, 10.11.0 – ≤ 10.11.10 | 11.4.0 |
Advisories 1
- WID-SEC-2026-0422 Mattermost: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 19, 2026
References
- MMSA-2025-00528 vendor-advisory