Mattermost Arbitrary Code Execution Vulnerability via Malicious Plugin Upload

A vulnerability allowing admin users to execute arbitrary code has been identified in Mattermost versions 10.8.x through 10.8.3, 10.5.x through 10.5.8, 9.11.x through 9.11.17, 10.10.x through 10.10.1, and 10.9.x through 10.9.3. The issue arises from the application's failure to properly validate import directory path configurations, which enables the upload of malicious plugins to a prepackaged plugins directory.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Mattermost is running.

Remediation

Users can upgrade to Mattermost versions 10.12.0, 10.11.0, or 10.5.11 to address this vulnerability.