CVE-2025-25274

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.

Published: Mar 21, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-25274
GHSA: GHSA-4v65-xqcj-wpgg
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWEs:

CWE-863
CWE-77

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	10.4.0	10.4.3
github.com/mattermost/mattermost/server/v8	10.3.0	10.3.4
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.9
github.com/mattermost/mattermost/server/v8	10.5.0	10.5.0.x
github.com/mattermost/mattermost/server/v8	10.5.0	10.5.1
mattermost / mattermost_server	10.3.0	10.3.4
mattermost / mattermost_server	10.4.0	10.4.3
mattermost / mattermost_server	9.11.0	9.11.9

https://mattermost.com/security-updates

Vulnerability Database

CVE-2025-25274

Deep Security Visibility Without the Complexity