Skip to content

x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-gq3r-5833-5532 #3901

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-gq3r-5833-5532#3901
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Aug 21, 2025

Advisory GHSA-gq3r-5833-5532 references a vulnerability in the following Go modules:

Module
github.com/mattermost/mattermost-server
github.com/mattermost/mattermost-server/v5
github.com/mattermost/mattermost-server/v6
github.com/mattermost/mattermost/server/v8

Description:
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      non_go_versions:
        - introduced: TODO (earliest fixed "9.11.18", vuln range ">= 9.11.0, <= 9.11.17")
        - introduced: TODO (earliest fixed "10.5.9", vuln range ">= 10.5.0, <= 10.5.8")
        - introduced: TODO (earliest fixed "10.8.4", vuln range ">= 10.8.0, <= 10.8.3")
        - introduced: TODO (earliest fixed "10.9.2", vuln range ">= 10.9.0, <= 10.9.1")
      vulnerable_at: 10.11.1+incompatible
    - module: github.com/mattermost/mattermost-server/v5
      vulnerable_at: 5.39.3
    - module: github.com/mattermost/mattermost-server/v6
      vulnerable_at: 6.7.2
    - module: github.com/mattermost/mattermost/server/v8
      non_go_versions:
        - fixed: 8.0.0-20250619095651-9dd0b3943e55
      vulnerable_at: 8.0.0-20250821142646-3f2ff6ea7145
summary: Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-36530
ghsas:
    - GHSA-gq3r-5833-5532
references:
    - advisory: https://github.com/advisories/GHSA-gq3r-5833-5532
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-36530
    - web: https://mattermost.com/security-updates
notes:
    - fix: 'module merge error: could not merge versions of module github.com/mattermost/mattermost-server: invalid or non-canonical semver version (found TODO (earliest fixed "9.11.18", vuln range ">= 9.11.0, <= 9.11.17"))'
source:
    id: GHSA-gq3r-5833-5532
    created: 2025-08-21T16:03:33.345869307Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

No one assigned

    Labels

    triaged

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions