{"id":"EUVD-2025-30242","enisaUuid":"765b74b3-f6ba-35c9-96d9-e0aa834244a0","description":"Mattermost versions 10.8.x \u003c\u003d 10.8.3, 10.5.x \u003c\u003d 10.5.8, 9.11.x \u003c\u003d 9.11.17, 10.10.x \u003c\u003d 10.10.1, 10.9.x \u003c\u003d 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory","datePublished":"Sep 19, 2025, 7:22:00 PM","dateUpdated":"Feb 26, 2026, 5:48:20 PM","baseScore":8.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-9079\nGHSA-qx3f-6vq3-8j8m\n","assigner":"Mattermost","epss":0.64,"enisaIdProduct":[{"id":"33605ea0-fbe6-3503-aab8-c0c8bd9046fa","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.8.0 ≤10.8.3"},{"id":"3548d236-0f9e-3adb-9b9e-0c8fb26d777b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"},{"id":"86dd3a29-6046-3ab5-a55f-b06de36280b1","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"ac6614c7-e051-3ab2-8a01-1851bb9dcd3c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.10.0 ≤10.10.1"},{"id":"d7cc7ca7-e234-3bc8-b0e6-6a07369e06b0","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.9.0 ≤10.9.3"}],"enisaIdVendor":[{"id":"f6a18de5-9904-344f-a1af-43715fd33df6","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"d9d08d74-b104-3bd3-ad98-5eb8a6212c48","vulnerability":{"id":"CVE-2025-9079","description":"Mattermost versions 10.8.x \u003c\u003d 10.8.3, 10.5.x \u003c\u003d 10.5.8, 9.11.x \u003c\u003d 9.11.17, 10.10.x \u003c\u003d 10.10.1, 10.9.x \u003c\u003d 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory","datePublished":"Sep 19, 2025, 7:22:00 PM","dateUpdated":"Feb 26, 2026, 5:48:20 PM","status":"PUBLISHED","baseScore":8.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-30242\n","assigner":"Mattermost","epss":0.64,"dataProcessed":"Nov 1, 2026, 1:37:31 AM","vulnerabilityProduct":[{"id":"0599b9fa-6cf5-3c20-8087-7ade548c3412","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.10.0 ≤10.10.1"},{"id":"b5b46d93-f1f4-3daa-8b50-8334d08b0fa0","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"d008be95-d54a-3cae-91be-6adb95f76127","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.9.0 ≤10.9.3"},{"id":"d06afd30-7729-31b3-99e2-0fdcd9cece4c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"},{"id":"ffeb49de-9acd-30db-89a8-bdb26528c54c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.8.0 ≤10.8.3"}],"vulnerabilityVendor":[{"id":"0590632c-1d43-3aa9-8f55-fce546733411","vendor":{"name":"Mattermost"}}]}},{"id":"ecec6209-4a0f-3e3a-bb4d-935959b974ff","vulnerability":{"id":"GHSA-qx3f-6vq3-8j8m","description":"Mattermost Path Traversal vulnerability","datePublished":"Sep 19, 2025, 9:31:21 PM","dateUpdated":"Sep 26, 2025, 4:24:11 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-9079\nhttps://github.com/mattermost/mattermost/commit/047a2c64071749367fe02d2162f6103a3d31a883\nhttps://github.com/mattermost/mattermost/commit/439464883aa16a329c23cd6274c4cca7e88e238f\nhttps://github.com/mattermost/mattermost/commit/4ff68eea0a3f3777032d31a1a82f4b1fb492a1ac\nhttps://github.com/mattermost/mattermost/commit/96665b9b98a17534fcd515982a2eb26950581e41\nhttps://github.com/mattermost/mattermost/commit/a8fa77f107efe83f09a779f8e67cbecf236b0032\nhttps://github.com/mattermost/mattermost/commit/b38e2eccda182212a8032539658723c7d87e0b7e\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\nhttps://pkg.go.dev/vuln/GO-2025-3977\n","enisa_id":"EUVD-2025-30242\n","aliases":"CVE-2025-9079\nGHSA-qx3f-6vq3-8j8m\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"4797bea7-25b5-394b-b28a-efff25526956","advisory":{"id":"openSUSE-SU-2025:15576-1","description":"govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media","datePublished":"Sep 25, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:42:15 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15576-1.json\nhttps://www.suse.com/security/cve/CVE-2025-10630/\nhttps://www.suse.com/security/cve/CVE-2025-59341/\nhttps://www.suse.com/security/cve/CVE-2025-59342/\nhttps://www.suse.com/security/cve/CVE-2025-59345/\nhttps://www.suse.com/security/cve/CVE-2025-59346/\nhttps://www.suse.com/security/cve/CVE-2025-59347/\nhttps://www.suse.com/security/cve/CVE-2025-59348/\nhttps://www.suse.com/security/cve/CVE-2025-59349/\nhttps://www.suse.com/security/cve/CVE-2025-59350/\nhttps://www.suse.com/security/cve/CVE-2025-59351/\nhttps://www.suse.com/security/cve/CVE-2025-59352/\nhttps://www.suse.com/security/cve/CVE-2025-59353/\nhttps://www.suse.com/security/cve/CVE-2025-59354/\nhttps://www.suse.com/security/cve/CVE-2025-59410/\nhttps://www.suse.com/security/cve/CVE-2025-9079/\nhttps://www.suse.com/security/cve/CVE-2025-9081/\n","aliases":"CVE-2025-10630\nCVE-2025-59341\nCVE-2025-59342\nCVE-2025-59345\nCVE-2025-59346\nCVE-2025-59347\nCVE-2025-59348\nCVE-2025-59349\nCVE-2025-59350\nCVE-2025-59351\nCVE-2025-59352\nCVE-2025-59353\nCVE-2025-59354\nCVE-2025-59410\nCVE-2025-9079\nCVE-2025-9081\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"00214a2d-9bbd-31ea-a4fb-684ec2ff20d5","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"0cce59cf-569b-3ece-92b4-dd55f5b819a0","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1bff9a38-13c6-39a2-9eb6-176e1445f406","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"336a9cde-230f-302f-8ec2-8cd30fab322f","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5c801d8c-6101-3ed7-a4a3-2cb1b3edf770","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"af4d3cd0-e6bb-381b-985e-56153abf8c49","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"ca324835-c24c-3355-96a7-d8fb95f68e90","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cfaf5451-3210-392e-b392-fde4ccb0ab2b","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ddb36019-723e-3336-805f-e23ace80eaec","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}