GHSA-72v2-v53v-4qmm
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/public | < 0.1.22 | 0.1.22 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2026-13426
- https://github.com/mattermost/mattermost/pull/34499
- https://github.com/mattermost/mattermost/pull/39305
- https://github.com/mattermost/mattermost/commit/2b075c9b74effbb56f3769f1bdec161eef4c6808
- https://github.com/mattermost/mattermost/commit/64c16ff0ea7f455ee648bfe906407def1274fbd3
- https://github.com/mattermost/mattermost
- https://github.com/mattermost/mattermost/releases/tag/server/public/v0.1.22
- https://mattermost.com/security-updates