Cyber Posture

CVE-2025-20621

Medium

Published: 16 January 2025

Published
16 January 2025
Modified
01 October 2025
KEV Added
Patch
CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0039 60.1th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20621 is a medium-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-11 requires proper error handling for unhandled exceptions like casting failures in attachment fields, directly preventing webapp crashes from malformed posts.

prevent

SI-10 mandates validation of information inputs such as attachment fields in posts, blocking malformed data that cannot be cast to strings from causing denial-of-service.

prevent

SI-2 ensures timely identification, reporting, and correction of flaws like this unhandled casting error in Mattermost, mitigating the vulnerability through patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Malformed post attachment triggers unhandled exception leading to webapp crash (DoS); directly matches exploitation of public-facing app and application/system exploitation for availability impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash…

more

via creating and sending such a post to a channel.

Deeper analysisAI

CVE-2025-20621 is a vulnerability in Mattermost versions 10.2.x up to and including 10.2.0, 9.11.x up to 9.11.5, 10.0.x up to 10.0.3, and 10.1.x up to 10.1.3. It arises from the webapp's failure to properly handle posts containing attachments with fields that cannot be cast to a String. An attacker can exploit this by creating and sending such a post to a channel, resulting in a crash of the webapp. The issue carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-1287.

The attack requires network access and low privileges, such as those of an authenticated user, with low complexity and no user interaction. By posting a malformed attachment to any channel, the attacker triggers an unhandled casting error that crashes the Mattermost webapp, leading to a denial-of-service condition that disrupts availability for all users without compromising confidentiality or integrity.

Mattermost has published details on mitigations in their security updates, available at https://mattermost.com/security-updates.

Details

CWE(s)

Affected Products

mattermost
mattermost server
10.2.0 · 9.11.0 — 9.11.6 · 10.0.0 — 10.0.4 · 10.1.0 — 10.1.4

CVEs Like This One

CVE-2026-2454Same product: Mattermost Mattermost Server
CVE-2026-24458Same product: Mattermost Mattermost Server
CVE-2026-20719Same product: Mattermost Mattermost Server
CVE-2025-14273Same product: Mattermost Mattermost Server
CVE-2025-25279Same product: Mattermost Mattermost Server
CVE-2025-25274Same product: Mattermost Mattermost Server
CVE-2025-25068Same product: Mattermost Mattermost Server
CVE-2025-24490Same product: Mattermost Mattermost Server
CVE-2025-12421Same product: Mattermost Mattermost Server
CVE-2025-12419Same product: Mattermost Mattermost Server

References