BaseFortify

Publication date: 2025-12-17

Last updated on: 2025-12-29

Assigner: Mattermost, Inc.

Description

Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2025-12-29

Generated

2026-07-06

AI Q&A

2025-12-17

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62690

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Mattermost versions 10.11.x up to 10.11.4, where the application fails to properly validate redirect URLs on the /error page. This flaw allows an attacker to craft a malicious link that, when opened in a new tab by a victim, redirects them to a malicious site.

Impact Analysis

The vulnerability can impact you by enabling attackers to redirect users to malicious websites through crafted links. This can lead to phishing attacks, malware downloads, or other malicious activities that compromise user security and trust.

Hi! I’m here to help you understand CVE-2025-62690. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70