What is the CVSS score of CVE-2025-31363?

CVE-2025-31363 has a CVSS 3.1 base score of 3.0 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Mattermost Server are affected by CVE-2025-31363?

CVE-2025-31363 is a low-severity vulnerability (CVSS 3.0). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2025-31363?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Mattermost Server CVE-2025-31363

LOW

2025-04-16 responsibledisclosure@mattermost.com

Code Injection Atlassian Mattermost Server

3.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:37 vuln.today

CVE Published

Apr 16, 2025 - 10:15 nvd

LOW 3.0

DescriptionNVD

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.

AnalysisAI

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an. Rated low severity (CVSS 3.0), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.