CVE-2025-58084: Mattermost Desktop App crashes when clicking on malformed external URL

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-13 · updated 2026-10-19
Weakness: CWE-1287

Description

Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.

Affected products

Mattermost Desktop: before 5.13.1.0 — fixed in 5.13.1.0

How to fix

Upgrade to a fixed version: Mattermost Desktop 5.13.1.0. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2025-58084 or the next vulnerability affects your stack