| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 10.10.0, < 10.10.2≥ 10.10.0+incompatible, < 10.10.2+incompatible≥ 10.5.0, < 10.5.9≥ 10.5.0+incompatible, < 10.5.9+incompatible≥ 10.8.0, < 10.8.4≥ 10.8.0+incompatible, < 10.8.4+incompatible≥ 10.9.0, < 10.9.4≥ 10.9.0+incompatible, < 10.9.4+incompatible≥ 9.11.0, < 9.11.18≥ 9.11.0+incompatible, < 9.11.18+incompatible | 10.10.210.10.2+incompatible10.5.910.5.9+incompatible10.8.410.8.4+incompatible10.9.410.9.4+incompatible9.11.189.11.18+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250707221302-a8fa77f107ef | 8.0.0-20250707221302-a8fa77f107ef |
| mattermost server | ≥ 10.10.0, < 10.10.2≥ 10.5.0, < 10.5.9≥ 10.8.0, < 10.8.4≥ 10.9.0, < 10.9.4≥ 9.11.0, < 9.11.18 | 10.10.210.5.910.8.410.9.49.11.18 |
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free