Skip to main content

Improper Validation of Specified Type of Input

CVE-2025-20086

Medium
6.5/10

Summary

Mattermost versions 9.11.x prior to 9.11.6-rc1, 10.0.x prior to 10.0.4-rc1, 10.1.x prior to 10.1.4-rc1, and 10.2.x prior to 10.2.1-rc1 fails to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post. This has the same fix as CVE-2025-20088, and CVE-2025-20621.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-1287 - Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References

Advisory Timeline

  • Published