CVE-2025-36530
Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
概要
Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com