Listen to this Post
How the CVE Works
The vulnerability arises due to improper sanitization of file attachment paths in bulk import JSONL files within Mattermost. A system admin can manipulate the input path to perform directory traversal (e.g., using `../` sequences), allowing unauthorized access to arbitrary system files. This occurs because the application fails to validate or restrict file paths during the bulk import process, leading to local file inclusion.
DailyCVE Form
Platform: Mattermost
Version: 10.8.0-10.8.1
Vulnerability: Path Traversal
Severity: Moderate
Date: Jul 18, 2025
Prediction: Patch by Jul 28, 2025
What Undercode Say
Check vulnerable versions
curl -s https://api.mattermost.com/version | grep "10.8.1"
Exploit PoC (simulated traversal)
echo '{"attachments":[{"path":"../../etc/passwd"}]}' > payload.jsonl
mmctl import bulk payload.jsonl
How Exploit
1. Craft malicious JSONL with traversal sequences.
2. Abuse bulk import feature.
3. Extract sensitive system files.
Protection from this CVE
- Update to patched versions.
- Restrict bulk import permissions.
- Implement strict path validation.
Impact
- Unauthorized file disclosure.
- Privilege escalation risk.
- Compromised system integrity.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
