A path traversal vulnerability exists in the Mattermost Go module github.com/mattermost/mattermost/server/public versions prior to 0.1.22. The flaw allows attackers to manipulate API route paths by injecting crafted IDs containing path traversal sequences, redirecting API calls to unintended endpoints. This vulnerability is identified as CVE-2026-13426 and has been assigned a medium severity rating with a CVSS score of 5.4.