CVE-2026-6961: Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync
(updated )
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server’s filestore via path traversal sequences in the filename field. Mattermost Advisory ID: MMSA-2026-00661
References
- github.com/advisories/GHSA-8qq9-cqj8-82w4
- github.com/mattermost/mattermost/commit/61d68d2d6ee81a5919597d91c736c502d7156859
- github.com/mattermost/mattermost/commit/a0056ed68d95f64d7c4586985e7b7f16b96b3bec
- github.com/mattermost/mattermost/commit/a9f3868e1eee9ec61855cd7277f39937385efffd
- github.com/mattermost/mattermost/commit/c021eeaff8f003034ab40f82c552cc26a710a8fd
- github.com/mattermost/mattermost/commit/c896a63dc44c2f9c081a0a15bfddc4e6eb50e753
- github.com/mattermost/mattermost/pull/36223
- github.com/mattermost/mattermost/pull/36251
- github.com/mattermost/mattermost/pull/36252
- github.com/mattermost/mattermost/pull/36253
- github.com/mattermost/mattermost/pull/36255
- github.com/mattermost/mattermost/releases/tag/v10.11.16
- github.com/mattermost/mattermost/releases/tag/v11.5.5
- github.com/mattermost/mattermost/releases/tag/v11.6.2
- github.com/mattermost/mattermost/releases/tag/v11.7.0
- mattermost.com/security-updates
- nvd.nist.gov/vuln/detail/CVE-2026-6961
Code Behaviors & Features
Detect and mitigate CVE-2026-6961 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →