CVE-2025-21088

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-704

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-210895.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.CVE-2025-21095.8The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions CVE-2025-210906.5Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to potentially enable de CVE-2025-210917.5When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Softwa CVE-2025-210926.5GMOD Apollo does not have sufficient logical or access checks when updating a user's information. This could result in an attacker being abl CVE-2025-210936.7Uncontrolled search path element for some Intel(R) Driver & Support Assistant Tool software before version 24.6.49.8 may allow an authen CVE-2025-210947.5Improper input validation in the UEFI firmware DXE module for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to po CVE-2025-210954.9Path traversal may lead to arbitrary file download. The score without least privilege principle violation is as calculated below. In combi CVE-2025-210961.9Improper buffer restrictions in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege CVE-2025-210975.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.CVE-2025-210985.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.CVE-2025-210996.7Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege v