CVE-2025-9079
Full vulnerability record from the local CVENow database.
Description
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-09-19 20:15:40.540000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-9079",
"sourceIdentifier": "[email protected]",
"published": "2025-09-19T20:15:40.540",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory"
},
{
"lang": "es",
"value": "Las versiones de Mattermost 10.8.x menor o igual que 10.8.3, 10.5.x menor o igual que 10.5.8, 9.11.x menor o igual que 9.11.17, 10.10.x menor o igual que 10.10.1, 10.9.x menor o igual que 10.9.3 fallan al validar la configuración de la ruta del directorio de importación, lo que permite a los usuarios administradores ejecutar código arbitrario a través de la carga de un plugin malicioso al directorio de plugins preempaquetados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Mattermost",
"product": "Mattermost",
"defaultStatus": "unaffected",
"versions": [
{
"version": "10.8.0",
"lessThanOrEqual": "10.8.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.5.0",
"lessThanOrEqual": "10.5.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.11.0",
"lessThanOrEqual": "9.11.17",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.10.0",
"lessThanOrEqual": "10.10.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.9.0",
"lessThanOrEqual": "10.9.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.11.0",
"status": "unaffected"
},
{
"version": "10.8.4",
"status": "unaffected"
},
{
"version": "10.5.9",
"status": "unaffected"
},
{
"version": "9.11.18",
"status": "unaffected"
},
{
"version": "10.10.2",
"status": "unaffected"
},
{
"version": "10.9.4",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.3,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-20T03:55:43.937191Z",
"id": "CVE-2025-9079",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.11.0",
"versionEndExcluding": "9.11.18",
"matchCriteriaId": "4E2C0E13-B52A-4539-80B6-DC0FE8FF2E56"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.5.0",
"versionEndExcluding": "10.5.9",
"matchCriteriaId": "B95DCAE5-07C2-46B1-B03E-ED3FB9B2C568"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.8.0",
"versionEndExcluding": "10.8.4",
"matchCriteriaId": "BE00156D-6ACB-4F8C-BFFC-03A8127199A4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.9.0",
"versionEndExcluding": "10.9.4",
"matchCriteriaId": "BB49CDD5-C206-4BEC-8CB5-D757DCC43208"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.10.0",
"versionEndExcluding": "10.10.2",
"matchCriteriaId": "F3861BBC-7E0F-4782-9666-4EF12C1ABDF5"
}
]
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}