Low severity · published Dec 17, 2025
CVE-2025-13321
Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the…
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Mattermost Desktop · Mattermost
before 6.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13321
Vendor Advisory
https://mattermost.com/security-updates
More from Mattermost Desktop
9.8
CVE-2016-11064
An issue was discovered in Mattermost Desktop App before 3.4.0
9.8
CVE-2019-20856
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS
8.8
CVE-2019-20861
An issue was discovered in Mattermost Desktop App before 4.2.2
7.8
CVE-2024-39613
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the…
7.7
CVE-2026-6517
Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed