CVE-2026-13426: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Mattermost github.com/mattermost/mattermost/server/public
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
AI Analysis
Technical Summary
The Mattermost Go module github.com/mattermost/mattermost/server/public versions before v0.1.22 do not adequately validate path parameters used in API route construction. This improper limitation of pathname to a restricted directory (CWE-22) enables attackers to craft IDs with path traversal components that redirect API calls to unintended endpoints. The vulnerability was assigned CVE-2026-13426 and is documented in Mattermost Advisory MMSA-2025-00532. No official patch or remediation level has been published at this time.
Potential Impact
An attacker with at least low privileges can exploit this vulnerability to manipulate API route paths, potentially redirecting API calls to unintended endpoints. This could lead to unauthorized information disclosure or modification of API behavior. The CVSS vector indicates low complexity and no user interaction required, but the impact on confidentiality and integrity is limited, with no impact on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Mattermost advisory MMSA-2025-00532 for current remediation guidance. Until an official fix is available, users should monitor the advisory for updates. No vendor-provided temporary fixes or workarounds are currently documented.
CVE-2026-13426: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Mattermost github.com/mattermost/mattermost/server/public
Description
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
CVSS v3.1
Score 5.4medium
Affected software
pkg:golang/github.com/mattermost/mattermost/server/publicRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Mattermost Go module github.com/mattermost/mattermost/server/public versions before v0.1.22 do not adequately validate path parameters used in API route construction. This improper limitation of pathname to a restricted directory (CWE-22) enables attackers to craft IDs with path traversal components that redirect API calls to unintended endpoints. The vulnerability was assigned CVE-2026-13426 and is documented in Mattermost Advisory MMSA-2025-00532. No official patch or remediation level has been published at this time.
Potential Impact
An attacker with at least low privileges can exploit this vulnerability to manipulate API route paths, potentially redirecting API calls to unintended endpoints. This could lead to unauthorized information disclosure or modification of API behavior. The CVSS vector indicates low complexity and no user interaction required, but the impact on confidentiality and integrity is limited, with no impact on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Mattermost advisory MMSA-2025-00532 for current remediation guidance. Until an official fix is available, users should monitor the advisory for updates. No vendor-provided temporary fixes or workarounds are currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Mattermost
- Date Reserved
- 2026-06-26T13:32:10.276Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3e8826cef61ccff97fbc80
Added to database: 06/26/2026, 14:09:42 UTC
Last enriched: 07/14/2026, 09:47:57 UTC
Last updated: 08/09/2026, 12:41:08 UTC
Views: 108
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.