Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field. Mattermost Advisory ID: MMSA-2026-00661
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-6961US | — | — | ||
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during sha… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mattermost/mattermostPACKAGE
- https://github.com/mattermost/mattermost/commit/61d68d2d6ee81a5919597d91c736c502d7156859WEB
- https://github.com/mattermost/mattermost/commit/a0056ed68d95f64d7c4586985e7b7f16b96b3becWEB
- https://github.com/mattermost/mattermost/commit/a9f3868e1eee9ec61855cd7277f39937385efffdWEB
- https://github.com/mattermost/mattermost/commit/c021eeaff8f003034ab40f82c552cc26a710a8fdWEB
- https://github.com/mattermost/mattermost/commit/c896a63dc44c2f9c081a0a15bfddc4e6eb50e753WEB
- https://github.com/mattermost/mattermost/pull/36223WEB
- https://github.com/mattermost/mattermost/pull/36251WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan