# Mattermost Mattermost Server


- [CVE-2025-12419](https://insights.sbomify.com/CVE-2025-12419/): Account takeover on OAuth/OpenID-enabled servers (critical 9.9)
- [CVE-2025-12421](https://insights.sbomify.com/CVE-2025-12421/): Account Takeover via Code Exchange Endpoint (critical 9.9)
- [CVE-2025-4981](https://insights.sbomify.com/CVE-2025-4981/): Path Traversal Leading to RCE by Any Authenticated Mattermost User (critical 9.9)
- [CVE-2025-20051](https://insights.sbomify.com/CVE-2025-20051/): Arbitrary file read via block duplication in Mattermost Boards (critical 9.9)
- [CVE-2025-25279](https://insights.sbomify.com/CVE-2025-25279/): Arbitrary file read in Mattermost Boards via import & export board archive (critical 9.9)
- [CVE-2016-11074](https://insights.sbomify.com/CVE-2016-11074/): Mattermost Server: Insufficient Password-Reset Link Invalidation (critical 9.8)
- [CVE-2017-18885](https://insights.sbomify.com/CVE-2017-18885/): Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials (critical 9.8)
- [CVE-2017-18888](https://insights.sbomify.com/CVE-2017-18888/): Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests (critical 9.8)
- [CVE-2017-18900](https://insights.sbomify.com/CVE-2017-18900/): Mattermost Server is vulnerable CSV Injection (critical 9.8)
- [CVE-2017-18908](https://insights.sbomify.com/CVE-2017-18908/): Mattermost Server password reset email requests can be sent to attacker-provided email addresses (critical 9.8)
- [CVE-2017-18912](https://insights.sbomify.com/CVE-2017-18912/): Mattermost Server allows an attacker to specify a full pathname of a log file (critical 9.8)
- [CVE-2017-18915](https://insights.sbomify.com/CVE-2017-18915/): Mattermost Server server restarts may provide attackers with API access (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/mattermost/mattermost-server/