GHSA-pj6f-rc94-gw53
Mattermost Fails to Sanitize File Names
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 10.8.0, < 10.8.4 | 10.8.4 |
| Go | github.com/mattermost/mattermost-server | >= 10.5.0, < 10.5.9 | 10.5.9 |
| Go | github.com/mattermost/mattermost-server | >= 10.9.0, < 10.9.4 | 10.9.4 |
| Go | github.com/mattermost/mattermost-server | >= 10.10.0, < 10.10.1 | 10.10.1 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250708173752-d6b35c41f0ae5 | 8.0.0-20250708173752-d6b35c41f0ae5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.
References
External links from the advisory. They lead to third-party sites.