CVE-2026-6961
Received Received - Intake
Path Traversal in Mattermost via Federated File Sync

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field.. Mattermost Advisory ID: MMSA-2026-00661
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-6961
EUVD
EUVD-2026-36504
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.6.1 (inc)
mattermost mattermost to 11.5.4 (inc)
mattermost mattermost to 10.11.15 (inc)
mattermost mattermost to 10.11.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should update Mattermost to a version later than the affected versions (11.6.1, 11.5.4, 10.11.15, or 10.11.16) where the issue has been fixed.

Additionally, monitor the official Mattermost Security Updates page for any patches or further guidance.

Executive Summary

This vulnerability exists in Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16. It occurs because Mattermost fails to properly sanitize the FileInfo.Name field received from federated peers during shared channel file synchronization. An attacker who controls a federated server can exploit this by including path traversal sequences in the filename, allowing them to write files to arbitrary locations within the target server's filestore.

Impact Analysis

The vulnerability can allow an attacker with control over a federated server to write files to arbitrary locations on the target server's file storage. This can lead to unauthorized file modification or creation, potentially compromising the integrity of the system, enabling further attacks, or causing denial of service.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart