Mattermost up to 10.10.1 Link Preview weak hash

Summaryinfo

A vulnerability was found in Mattermost up to 9.11.17/10.5.8/10.8.3/10.9.3/10.10.1. It has been rated as problematic. This affects an unknown part of the component Link Preview Handler. The manipulation leads to weak hash. This vulnerability is uniquely identified as CVE-2025-9078. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Mattermost up to 9.11.17/10.5.8/10.8.3/10.9.3/10.10.1 and classified as problematic. This issue affects an unknown function of the component Link Preview Handler. The manipulation with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is confidentiality. The summary by CVE is:

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing

The weakness was disclosed by daw10. The advisory is shared at mattermost.com. The identification of this vulnerability is CVE-2025-9078 since 08/15/2025. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 9.11.18, 10.5.9, 10.8.4, 10.9.4, 10.10.2 or 10.11.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 9.11.0
• 9.11.1
• 9.11.2
• 9.11.3
• 9.11.4
• 9.11.5
• 9.11.6
• 9.11.7
• 9.11.8
• 9.11.9
• 9.11.10
• 9.11.11
• 9.11.12
• 9.11.13
• 9.11.14
• 9.11.15
• 9.11.16
• 9.11.17
• 10.5.0
• 10.5.1
• 10.5.2
• 10.5.3
• 10.5.4
• 10.5.5
• 10.5.6
• 10.5.7
• 10.5.8
• 10.8.0
• 10.8.1
• 10.8.2
• 10.8.3
• 10.9.0
• 10.9.1
• 10.9.2
• 10.9.3
• 10.10.0
• 10.10.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion