Security Advisory

CVE-2025-36530

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-08-21 07:11:43

Last updated 2025-08-21 13:50:42

Assigner Mattermost

State PUBLISHED

Description

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

← Browse all CVEs View on cve.org ↗