# CVE-2025-36530: Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

> CVE-2025-36530: Import Path Traversal Enables Unauthorized Unsigned Plugin Installation. CVSS 6.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-36530
Last updated: 2026-06-17T09:14:46Z

- Published: 2025-08-21 07:11 UTC · Updated: 2026-06-17 09:14 UTC · Assigner: Mattermost
- CVSS: 6.8 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- EPSS: 0.49%, 42th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

Mattermost versions 10.9.x \<= 10.9.1, 10.8.x \<= 10.8.3, 10.5.x \<= 10.5.8, 9.11.x \<= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

## Affected vendors and products

- Mattermost: Mattermost

## Tracked companies

- [Mattermost](https://rewindex.com/company/mattermost.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-36530)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-36530)
- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-36530 · Markdown: https://rewindex.com/cve/CVE-2025-36530.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-36530 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:16:21.633Z