GO-2025-4187
NoneCVSS
—
EPSS
—
Published
Dec 8, 2025
CISA due date
—
The record
Mattermost Server is vulnerable to Path Traversal when files are stored locally in github.com/mattermost/mattermost-server
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 0 | 4.1.2-0.20171004201910-6be8113eb60c |
| Go | github.com/mattermost/mattermost-server | 4.2.0-rc1.0.20171004154238-fadd9514f6e7 | 4.2.1-0.20171004194140-6d3cb2ce07fc |
| Go | github.com/mattermost/mattermost-server | 4.3.0-rc1 | 4.3.0 |
| Go | github.com/mattermost/mattermost-server | 4.3.0-rc1+incompatible | 4.3.0+incompatible |
| go | github.com/mattermost/mattermost-server | 4.3.0-rc1 | 4.3.0 |
Related vulnerabilities
- GO-2026-4305 Mattermost Server vulnerable to CSRF if CORS is enabled in… Also affects github.com/mattermost/mattermost-server
- GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as… Also affects github.com/mattermost/mattermost-server
- GO-2026-4326 Mattermost is vulnerable to DoS due to infinite re-renders on API errors in… Also affects github.com/mattermost/mattermost-server
- GO-2025-4260 Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created… Also affects github.com/mattermost/mattermost-server
- GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4282 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost… Also affects github.com/mattermost/mattermost-server
- GO-2026-4520 Mattermost fails to properly validate login method restrictions in… Also affects github.com/mattermost/mattermost-server