CVE-2025-36530 — Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

CVE-2025-36530

Import Path Traversal Enables Unauthorized Unsigned Plugin Installation PUBLISHED

Description (CNA)

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.9.0 through 10.9.1; affected 10.8.0 through 10.8.3; affected 10.5.0 through 10.5.8; affected 9.11.0 through 9.11.17; unaffected 10.10.0; unaffected 10.9.2; unaffected 10.8.4; unaffected 10.5.9; unaffected 9.11.18

CWE

CWE-22

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.