CVE-2025-20630
Mattermost Mobile ≤ 2.23.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-20630 is a medium-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Mattermost Mattermost Mobile. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Mattermost Mobile versions <=2.22.0 are affected by CVE-2025-20630, a vulnerability where the app fails to properly handle posts with attachments containing fields that cannot be cast to a String. This flaw allows an attacker to crash the mobile application by creating and sending such a malformed post to a channel. The issue is rated 6.5 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1287.
Attackers require low privileges as an authenticated user (PR:L) and can exploit it remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation results in a denial-of-service condition, crashing the Mattermost Mobile app for all recipients viewing the channel, with high availability impact (A:H) but no compromise of confidentiality or integrity.
The Mattermost security updates page at https://mattermost.com/security-updates details the vulnerability and mitigation, recommending an upgrade to Mattermost Mobile version 2.23.0 or later, which resolves the improper handling of non-String fields in attachments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2180
Vulnerability Data
Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly requires validation of information inputs, which structurally prevents type-validation failures from being introduced or exploitable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input type validation during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type-validation flaws but does not prevent them during development.
Secure development lifecycle mandates input validation and type checking to prevent improper type handling.
Application security requirements explicitly include validation of input data types and formats.
Secure architecture principles promote defensive input handling and type enforcement at system boundaries.
Secure coding standards directly require proper type validation of all external inputs.