Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-v469-7wp6-7cvp: Mattermost allows reading arbitrary files

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.

ghsa
Open in Source
#vulnerability#web#git#perl

Skip to content

Navigation Menu

    • GitHub Copilot

      Write better code with AI

    • Security

      Find and fix vulnerabilities

    • Actions

      Automate any workflow

    • Codespaces

      Instant dev environments

    • Issues

      Plan and track work

    • Code Review

      Manage code changes

    • Discussions

      Collaborate outside of code

    • Code Search

      Find more, search less

  • Explore

    • Learning Pathways
    • Events & Webinars
    • Ebooks & Whitepapers
    • Customer Stories
    • Partners
    • Executive Insights

    • GitHub Sponsors

      Fund open source developers

*   The ReadME Project
    
    GitHub community articles

    • Enterprise platform

      AI-powered developer platform

  • Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2025-20051

Mattermost allows reading arbitrary files

Critical severity GitHub Reviewed Published Feb 24, 2025 to the GitHub Advisory Database • Updated Feb 24, 2025

Package

gomod github.com/mattermost/mattermost/server/v8 (Go)

Affected versions

< 8.0.0-20250122165010-4ed702ccff4e

>= 9.11.0-rc1, < 9.11.8

>= 10.2.0-rc1, < 10.2.3

>= 10.3.0-rc1, < 10.3.3

>= 10.4.0-rc1, < 10.4.2

Patched versions

8.0.0-20250122165010-4ed702ccff4e

9.11.8

10.2.3

10.3.3

10.4.2

Description

Published to the GitHub Advisory Database

Feb 24, 2025

Last updated

Feb 24, 2025

EPSS score

ghsa: Latest News

GHSA-c6gw-w398-hv78: DoS in go-jose Parsing
ghsa