> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2025-20051/24490/25279: Mattermost Boards Arbitrary File Read Vulnerability in Multiple Versions
- URL: https://darkwebinformer.com/cve-2025-20051-24490-25279-mattermost-boards-arbitrary-file-read-vulnerability-in-multiple-versions/
- Published: 2025-02-24T17:37:55.000Z
- Updated: 2025-09-04T22:23:52.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities

🚨 Critical Security Vulnerability  
🆔 CVE-2025-20051, CVE-2025-24490, CVE-2025-25279  
💣 CVSS Score: 9.9, 9.6, 9.9  
📅 Published Date: 2025-02-24

⚠️ Details: CVE-2025-20051: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.

CVE-2025-24490: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.

CVE-2025-25279: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.

🛠 References:  
🔗 Mattermost: <https://mattermost.com/security-updates>  
🔗 NIST: <https://nvd.nist.gov/vuln/detail/CVE-2025-20051>, <https://nvd.nist.gov/vuln/detail/CVE-2025-24490>, <https://nvd.nist.gov/vuln/detail/CVE-2025-25279>