CVE-2026-6961

Analyzed Analyzed - Analysis Complete

Path Traversal in Mattermost via Federated File Sync

Publication date: 2026-06-12

Last updated on: 2026-06-18

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field.. Mattermost Advisory ID: MMSA-2026-00661

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-18

Generated

2026-07-03

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-6961

EUVD

EUVD-2026-36504

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.17 (exc)
mattermost	mattermost_server	From 11.5.0 (inc) to 11.5.5 (exc)
mattermost	mattermost_server	From 11.6.0 (inc) to 11.6.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16. It occurs because Mattermost fails to properly sanitize the FileInfo.Name field received from federated peers during shared channel file synchronization. An attacker who controls a federated server can exploit this by including path traversal sequences in the filename, allowing them to write files to arbitrary locations within the target server's filestore.

Impact Analysis

The vulnerability can allow an attacker with control over a federated server to write files to arbitrary locations on the target server's file storage. This can lead to unauthorized file modification or creation, potentially compromising the integrity of the system, enabling further attacks, or causing denial of service.

Mitigation Strategies

To mitigate this vulnerability, you should update Mattermost to a version later than the affected versions (11.6.1, 11.5.4, 10.11.15, or 10.11.16) where the issue has been fixed.

Additionally, monitor the official Mattermost Security Updates page for any patches or further guidance.

Hi! I’m here to help you understand CVE-2026-6961. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70