GHSA-c4r7-j7pp-r8mp

ghsaUSosv

Mattermost has a Path Traversal issue

view advisory published 2026-05-21Licence: CC-BY-4.0

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL. Mattermost Advisory ID: MMSA-2026-00640.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-4858US	critical9.9	0.33% (26th)	—	2026-05-21
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticat…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-4858ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan