Security Advisory

CVE-2026-6957

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-27 14:23:50

Last updated 2026-05-28 03:55:34

Assigner Mattermost

CVSS score 8.0

State PUBLISHED

Description

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore via a malicious filename delivered through the shared-channel attachment sync protocol. Mattermost Advisory ID: MMSA-2026-00659

← Browse all CVEs View on cve.org ↗