GitHub Advisoryadvisory · Go
GHSA-m2ch-x2q7-2284 Mattermost Server allows an attacker to specify a full pathname of a log file
HIGH
Official page ↗
- Aliases
- CVE-2017-18912
- Ecosystem
- Go
- Packages
- github.com/mattermost/mattermost-server
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-22
- Reviewed
- 2026-02-12
Affected packages
• Go github.com/mattermost/mattermost-server: < 3.7.4-0.20170404171331-0b5c0794fdcb → fixed in 3.7.4-0.20170404171331-0b5c0794fdcb
Description
An issue was discovered in Mattermost Server before 3.7.5. It allows an attacker to specify a full pathname of a log file.
Related
Alias · CVE (1)
- CVE-2017-18912 An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness