CVE Feed

    Dashboard / CVE / CVE-2025-20630

    CVE-2025-20630

    Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.

    Published:Jan 16, 2025
    Last Modified:Sep 24, 2025
    EPS:Jan 16, 2025
    EPSS Score:0.0015
    CVSS Score:6.5

    Affected Products

    Vendor
    Mattermost
    Product
    Mattermost Mobile

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-59480 (CVSS 6.1) — Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted se…
    CVE-2025-30516 (CVSS 2) — Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e…
    CVE-2025-1558 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows …
    CVE-2025-20072 (CVSS 6.5) — Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's styl…
    CVE-2025-0476 (CVSS 4.3) — Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which all…
    CVE-2025-21083 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authent…
    CVE-2025-20036 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authent…
    CVE-2024-11358 (CVSS 5.7) — Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an att…
    CVE-2024-45833 (CVSS 4.5) — Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password a…
    CVE-2024-39767 (CVSS 4.2) — Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server ac…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High