CVE-2025-49222: Mattermost Fails to Validate Remote Cluster Upload Sessions

August 21, 2025 (updated August 29, 2025)

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions which allows a system admin to upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

References

github.com/advisories/GHSA-q453-638c-h4mr
github.com/mattermost/mattermost
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-49222
pkg.go.dev/vuln/GO-2025-3904

Code Behaviors & Features

Detect and mitigate CVE-2025-49222 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →