CVE-2025-9079

Published Unknown

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-9079. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

0.0

/10

Not Available

Base Score Metrics

Exploitability: N/A Impact: N/A

Attack Vector Metrics

Attack Vector

Not Available

Attack Complexity

Not Available

Privileges Required

Not Available

User Interaction

Not Available

Scope

Not Available

Impact Metrics

Confidentiality

Not Available

Integrity

Not Available

Availability

Not Available

Description

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

EU Vulnerability Database

Monitored by ENISA for EU cybersecurity

EU Coordination

EU Coordinated

Exploitation Status

No Known Exploitation

EUVD ID

View on ENISA

ENISA Analysis

Malicious code in bioql (PyPI)

Affected Products (ENISA)

mattermost

ENISA Scoring

CVSS Score (3.1)

8.0

/10

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

0.130

probability

ENISA References

https://nvd.nist.gov/vuln/detail/CVE-2025-9079

https://github.com/mattermost/mattermost/commit/047a2c64071749367fe02d2162f6103a3d31a883

https://github.com/mattermost/mattermost/commit/439464883aa16a329c23cd6274c4cca7e88e238f

https://github.com/mattermost/mattermost/commit/4ff68eea0a3f3777032d31a1a82f4b1fb492a1ac

https://github.com/mattermost/mattermost/commit/96665b9b98a17534fcd515982a2eb26950581e41

https://github.com/mattermost/mattermost/commit/a8fa77f107efe83f09a779f8e67cbecf236b0032

https://github.com/mattermost/mattermost/commit/b38e2eccda182212a8032539658723c7d87e0b7e

https://github.com/mattermost/mattermost

https://mattermost.com/security-updates

https://pkg.go.dev/vuln/GO-2025-3977

Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH