GitHub Advisoryadvisory · Go

GHSA-jx93-pf6x-874r Mattermost doesn't escape some variables that could contain malicious content during error page composition

LOW Published 2026-05-18 Modified 2026-06-01 Official page ↗
Aliases
CVE-2026-3495
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-06-01

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 10.11.0, < 10.11.14 → fixed in 10.11.14 • Go github.com/mattermost/mattermost/server/v8: >= 11.5.0, < 11.5.2 → fixed in 11.5.2 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20260310115442-5a1ea95044d → fixed in 8.0.0-20260310115442-5a1ea95044d • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20260310115442-5a1ea95044dc → fixed in 5.3.2-0.20260310115442-5a1ea95044dc

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622

Related

Alias · CVE (1)

  • CVE-2026-3495 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References