What is GHSA-vqwh-5jhh-vc9p?

GHSA-vqwh-5jhh-vc9p is a security advisory published by GitHub Security Advisories with Low severity. Mattermost Server SSRF Vulnerability via the Agents Plugin

Which CVE IDs does GHSA-vqwh-5jhh-vc9p cover?

GHSA-vqwh-5jhh-vc9p covers the following CVE IDs: CVE-2025-47700. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqwh-5jhh-vc9p?

GHSA-vqwh-5jhh-vc9p has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vqwh-5jhh-vc9p?

GHSA-vqwh-5jhh-vc9p affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003e= 10.5.0, \u003c= 10.5.9; go/github.com/mattermost/mattermost/server/v8:\u003c 8.0.0-20250814075248-83a37a861d3c.

GHSA-vqwh-5jhh-vc9pLowCVSS 3.5

Mattermost Server SSRF Vulnerability via the Agents Plugin

Vendor

GitHub Security Advisories

Published

August 21, 2025

Last Modified

August 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-47700 →

📋 Description

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

🎯 Affected products2

go/github.com/mattermost/mattermost-server:>= 10.5.0, <= 10.5.9
go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250814075248-83a37a861d3c

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-47700
https://mattermost.com/security-updates
https://pkg.go.dev/vuln/GO-2025-3906
https://github.com/advisories/GHSA-vqwh-5jhh-vc9p