CVE-2017-18875

EPSS 0.13%

Mattermost Server does not prevent System Admin from arbitrary file creation

Published: 5/24/2022Modified: 12/9/2025

Also known as:GHSA-9rr5-q43r-ccv4GO-2025-4186

Description

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

Affected packages (2)

Go/github.com/mattermost/mattermost-serverfrom 0, < 4.1.2-0.20171004201910-6be8113eb60c
Go/github.com/mattermost/mattermost-server>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References (7)

ADVISORYhttps://github.com/advisories/GHSA-9rr5-q43r-ccv4
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-18875
PATCHhttps://github.com/mattermost/mattermost
WEBhttps://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086
WEBhttps://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa
WEBhttps://github.com/mattermost/mattermost/commit/fadd9514f6e71590aba781a7035e1de4150137b0
WEBhttps://mattermost.com/security-updates