GitHub Advisoryadvisory · Go

GHSA-86vc-mg26-fj6x Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds

MEDIUM Published 2026-03-25 Modified 2026-03-30 Official page ↗
Aliases
CVE-2026-20719
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-754
Reviewed
2026-03-30

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 11.4.0-rc1, < 11.4.1 → fixed in 11.4.1 • Go github.com/mattermost/mattermost/server/v8: >= 11.3.0-rc1, < 11.3.2 → fixed in 11.3.2 • Go github.com/mattermost/mattermost/server/v8: >= 11.2.0-rc1, < 11.2.4 → fixed in 11.2.4 • Go github.com/mattermost/mattermost/server/v8: >= 8.0.0-20260105080200-d27a2195068d, < 8.0.0-20260217110922-b7d4a1f1f59b → fixed in 8.0.0-20260217110922-b7d4a1f1f59b • Go github.com/mattermost/mattermost/server/v8: >= 10.11.0-rc1, < 10.11.2 → fixed in 10.11.2

Description

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595

Related

Alias · CVE (1)

  • CVE-2026-20719 Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on… vulnerability

Weakness · CWE (1)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References