GitHub Advisoryadvisory · Go

GHSA-c4r7-j7pp-r8mp Mattermost has a Path Traversal issue

HIGH Published 2026-05-21 Modified 2026-06-23 Official page ↗
Aliases
CVE-2026-4858
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-06-23

Affected packages

• Go github.com/mattermost/mattermost-server: >= 11.6.0, < 11.6.1 → fixed in 11.6.1 • Go github.com/mattermost/mattermost-server: >= 11.5.0, < 11.5.4 → fixed in 11.5.4 • Go github.com/mattermost/mattermost-server: >= 11.4.0, < 11.4.5 → fixed in 11.4.5 • Go github.com/mattermost/mattermost-server: >= 10.11.0, < 10.11.15 → fixed in 10.11.15

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL. Mattermost Advisory ID: MMSA-2026-00640.

Related

Alias · CVE (1)

  • CVE-2026-4858 Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References