Skip to content

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-f72g-52v7-mg3p #3978

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-f72g-52v7-mg3p#3978
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Sep 22, 2025

Advisory GHSA-f72g-52v7-mg3p references a vulnerability in the following Go modules:

Module
github.com/mattermost/mattermost-server

Description:
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - introduced: 9.11.0-rc1+incompatible
        - fixed: 9.11.18+incompatible
        - introduced: 10.5.0-rc1+incompatible
        - fixed: 10.5.9+incompatible
      non_go_versions:
        - fixed: 0.0.0-20250716054606-3f3e3becfe1d
        - fixed: 8.0.0-20250721095935-11c36f4d1e44
      vulnerable_at: 10.5.9-rc4+incompatible
summary: Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-9081
ghsas:
    - GHSA-f72g-52v7-mg3p
references:
    - advisory: https://github.com/advisories/GHSA-f72g-52v7-mg3p
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-9081
    - fix: https://github.com/mattermost/mattermost-plugin-boards/commit/3f3e3becfe1d66db0d0f4fd235f04afd6e1ec40b
    - fix: https://github.com/mattermost/mattermost-plugin-boards/pull/114
    - web: https://mattermost.com/security-updates
source:
    id: GHSA-f72g-52v7-mg3p
    created: 2025-09-22T18:02:46.19557202Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

No one assigned

    Labels

    triaged

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions