CVE-2025-4981

Mattermost Server does not sanitize file names when unpacking uploaded archives. An attacker with an account in the system can upload a specially crafted archive in which file names contain path traversal sequences (e.g., '../../'). During unpacking, the server saves files outside the intended target directory — in any location on the file system accessible to the server process. The vulnerability is active only when two configuration options are enabled simultaneously: FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true, which are active by default.

An authenticated attacker can overwrite or place arbitrary files on the server, which may lead to remote code execution (RCE) and thus complete takeover of the server instance, data disclosure, and violation of system integrity and availability.

Mattermost Server should be updated to versions higher than those indicated above (according to vendor references: https://mattermost.com/security-updates). As a temporary workaround, until a patch is applied, archive content extraction can be disabled by setting FileSettings.ExtractContent = false, which deactivates the vulnerable mechanism.

Mattermost Server in versions: 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 — with default configuration (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true)