CVE-2025-20072

🔶 medium

Summary

Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.

CVSS Score

6.5

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2025-01-16

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,890 vulnerabilities in our database.

#195,497

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jan 16, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

c0rydoras

SSVC data provided by CISA

Last Modified 2025-09-24

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-704

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
mattermost	mattermost_mobile	Affected	< 2.23.0

🔗 References 1

https://mattermost.com/security-updates

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-22880	🔶 medium	6.1	0.1	Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO aut...	2026-05-21
CVE-2025-59480	🔶 medium	6.1	0.0	Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, whic...	2025-11-13
CVE-2025-30516	ℹ️ low	2.0	0.1	Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor ...	2025-04-14
CVE-2025-1558	🔶 medium	6.5	0.1	Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a maliciou...	2025-03-24
CVE-2025-0476	🔶 medium	4.3	0.3	Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an att...	2025-01-16
CVE-2025-20630	🔶 medium	6.5	0.2	Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast...	2025-01-16

These CVEs affect the same products