Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-0476: Mattermost Mobile app can crash from malicious attachment name

CVE-2025-0476 · published 1 year ago

Summary

Versions of the Mattermost mobile app up to 2.22.0 may stop working if they receive a file whose name is deliberately crafted. If a user opens a channel that contains such a file, the app can close unexpectedly, disrupting work. Updating the app to a newer version removes the problem, so apply the latest update as soon as possible.

What to do

Update mattermost mattermost_mobile to version 2.23.0 or later.

Affected software

Vendor	Product	Affected versions
mattermost	mattermost_mobile	< 2.23.0 `cpe:2.3:a:mattermost:mattermost_mobile::::::::`

Original advisory text

Mobile crash via file with specially crafted filename

Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment

References

https://mattermost.com/security-updates URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0476.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-0476 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-1287Improper Validation of Specified Type of Input

Timeline

Published15 Jan 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-0476 · NVD

CVE-2025-0476 · OSV

Track software like this

Free during beta