CVE-2025-25274

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-252766.5An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-252777.0in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible ty CVE-2025-252787.0in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-252797.5Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when impor CVE-2025-25283.6Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use CVE-2025-252805.3Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by Cen CVE-2025-252817.5An attacker may modify the URL to discover sensitive information about the target network.CVE-2025-252828.1RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploi CVE-2025-252837.5parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to CVE-2025-252848.7The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS (Web Processing CVE-2025-252855.3@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting CVE-2025-252869.8Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4