CVE Feed

    Dashboard / CVE / CVE-2025-0476

    CVE-2025-0476

    Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment

    Published:Jan 15, 2025
    Last Modified:Sep 24, 2025
    EPS:Jan 15, 2025
    EPSS Score:0.00302
    CVSS Score:4.3

    Affected Products

    Vendor
    Mattermost
    Product
    Mattermost Mobile

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-59480 (CVSS 6.1) — Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted se…
    CVE-2025-30516 (CVSS 2) — Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e…
    CVE-2025-1558 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows …
    CVE-2025-20630 (CVSS 6.5) — Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cann…
    CVE-2025-20072 (CVSS 6.5) — Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's styl…
    CVE-2025-21083 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authent…
    CVE-2025-20036 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authent…
    CVE-2024-11358 (CVSS 5.7) — Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an att…
    CVE-2024-45833 (CVSS 4.5) — Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password a…
    CVE-2024-39767 (CVSS 4.2) — Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server ac…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High