{"id":"EUVD-2025-30242","revision":"b2eb562c82e94bae85c31ae16b5a8340","records":[{"revision":"b2eb562c82e94bae85c31ae16b5a8340","observedAt":"2026-11-01T01:20:00.583+00:00","statement":{"source":"euvd","id":"EUVD-2025-30242","aliases":["CVE-2025-9079","GHSA-qx3f-6vq3-8j8m"],"title":"Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upl…","description":"Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","score":8,"severity":null}],"references":["https://mattermost.com/security-updates"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30242","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 19, 2025, 7:22:00 PM","dateUpdated":"Feb 26, 2026, 5:48:20 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15576-1","title":"govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media","vulnerabilityIds":["CVE-2025-10630","CVE-2025-59341","CVE-2025-59342","CVE-2025-59345","CVE-2025-59346","CVE-2025-59347","CVE-2025-59348","CVE-2025-59349","CVE-2025-59350","CVE-2025-59351","CVE-2025-59352","CVE-2025-59353","CVE-2025-59354","CVE-2025-59410","CVE-2025-9079","CVE-2025-9081"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-30242","identifiers":["EUVD-2025-30242","CVE-2025-9079","GHSA-qx3f-6vq3-8j8m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}