CVE-2025-47700
AI plugin APIs can be triggered using post actions
Summary
AI plugin APIs can be triggered using post actions
Original description
The description as published by the source.
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com