How severe is CVE-2025-58084?

CVE-2025-58084 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-58084 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-58084?

CVE-2025-58084 affects Mattermost Mattermost Desktop. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-58084?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-58084 have an EU (EUVD) identifier?

Yes. CVE-2025-58084 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34084.

When was CVE-2025-58084 published?

CVE-2025-58084 was published on 2025-10-13 and last updated on 2026-06-17.

CVE-2025-58084

CVE-2025-58084 is a low-severity vulnerability in Mattermost Mattermost Desktop with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1287.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-34084
Weakness: CWE-1287
Affected product: Mattermost Mattermost Desktop
Published: 2025-10-13
Last modified: 2026-06-17

Description

Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.

Frequently asked questions

What is CVE-2025-58084?: Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
How severe is CVE-2025-58084?: CVE-2025-58084 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-58084 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-58084?: CVE-2025-58084 affects Mattermost Mattermost Desktop. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-58084?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-58084 have an EU (EUVD) identifier?: Yes. CVE-2025-58084 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34084.
When was CVE-2025-58084 published?: CVE-2025-58084 was published on 2025-10-13 and last updated on 2026-06-17.

References

https://mattermost.com/security-updates

Affected products (1)

cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*

More vulnerabilities in Mattermost Mattermost Desktop

CVE-2016-11064 — Critical (CVSS 9.8): An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVE-2019-20856 — Critical (CVSS 9.8): An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
CVE-2019-20861 — High (CVSS 8.8): An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a…
CVE-2026-1046 — High (CVSS 7.6): Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost…
CVE-2020-14456 — High (CVSS 7.3): An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during…
CVE-2026-8683 — Medium (CVSS 6.5): Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the…

All CVEs affecting Mattermost Mattermost Desktop →

Other CWE-1287 vulnerabilities

CVE-2024-51550 — Critical (CVSS 10.0): Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in…
CVE-2024-6298 — Critical (CVSS 10.0): Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series…
CVE-2026-44935 — Critical (CVSS 9.9): Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before…
CVE-2024-4879 — Critical (CVSS 9.8): ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now…
CVE-2021-32024 — Critical (CVSS 9.8): A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an…
CVE-2026-24307 — Critical (CVSS 9.3): Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information…

Browse all CWE-1287 vulnerabilities →