CVE-2025-25279

Mattermost Server fails to properly validate board blocks when importing boards through its Boards feature, a path traversal flaw (CWE-22). An attacker submits a specially crafted board import archive and then exports it, causing the traversal to embed files from elsewhere on the server's filesystem into the exported archive. This yields an arbitrary file read, which can expose sensitive server contents such as configuration files containing database credentials and other secrets. Instances running affected 10.4.x, 10.3.x, 10.2.x, or 9.11.x releases with board import available to users are at risk; the CVSS vector indicates no special privileges or user interaction are required. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not in CISA KEV, but the EPSS score of 24.2% (98th percentile) signals an elevated likelihood of exploitation attempts within 30 days.

What to do: Upgrade Mattermost Server to a release newer than the affected ceiling in your line — above 10.4.1, 10.3.2, 10.2.2, or 9.11.7 as applicable (i.e., the current patched release of each supported series). Until patched, limit board import to trusted users or disable the Boards feature/plugin if it is not used. Given the arbitrary file read, review whether sensitive files such as the Mattermost config (which holds database and SMTP credentials) could have been exposed, and watch for import activity in server logs.