The Mattermost Go module github.com/mattermost/mattermost/server/public versions before v0.1.22 do not correctly validate pathname parameters when building API route paths. This improper limitation of a pathname to a restricted directory (CWE-22) enables an attacker with limited privileges to craft IDs with path traversal components, causing API calls to be redirected to unintended endpoints. The vulnerability was assigned CVE-2026-13426 and is documented in Mattermost Advisory MMSA-2025-00532. No official patch or remediation level has been published as of the advisory date.

An attacker with limited privileges can exploit this vulnerability to redirect API calls to unintended endpoints by using crafted path traversal sequences in IDs. This can lead to limited confidentiality and integrity impacts on the affected system, but no availability impact has been reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided in the advisory, users should monitor Mattermost's official channels for updates. Until a patch is available, avoid using affected versions or apply any recommended temporary mitigations from the vendor if provided.