Live › vulnerability › CVE-2026-13426
The Mattermost Go module github.com/mattermost/mattermost/server/public before v0.1.22 does not validate path parameters when building API route paths. A crafted ID containing path traversal components can redirect API calls to unintended endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 22:07 UTC. All times on this page are UTC.
Projects that import the Mattermost Go client module and pass user-supplied or external IDs into its API calls are the exposed ones. Code that only uses the module with fixed, trusted IDs is less likely to be reached by the crafted input. The sources do not describe which specific client methods are affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/mattermost/mattermost/server/public | go | < 0.1.22 | 0.1.22 |
go list -m github.com/mattermost/mattermost/server/public in the project and check the version shown.github.com/mattermost/mattermost/server/public.v0.1.22Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
This page as .md · .json · in your agent: get_signal("CVE-2026-13426")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.