CVE-2025-20621

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.

Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.

Las versiones de Mattermost 10.2.x &lt;= 10.2.0, 9.11.x &lt;= 9.11.5, 10.0.x &lt;= 10.0.3, 10.1.x &lt;= 10.1.3 no gestionan adecuadamente las publicaciones con archivos adjuntos que contienen campos que no se pueden convertir a una cadena, lo que permite a un atacante hacer que la aplicación web se bloquee al crear y enviar dicha publicación a un canal.