{"id":"CVE-2026-13426","kind":"vulnerability","aliases":["CVE-2026-13426","GHSA-72v2-v53v-4qmm"],"related":[],"title":"github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction","description":"The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532","summary":"The Mattermost Go module github.com/mattermost/mattermost/server/public before v0.1.22 does not validate path parameters when building API route paths. A crafted ID containing path traversal components can redirect API calls to unintended endpoints.","severity":"medium","cvss":5.4,"epss":0.00291,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/mattermost/mattermost/server/public","fixed":["0.1.22"],"affected":"< 0.1.22","ecosystem":"go"}],"ecosystems":["go"],"tags":["api-clients","cwe-22","go","mattermost","package"],"not_affected_if":["fixed-ids-only","not-using-module"],"how_to_check":"- Run `go list -m github.com/mattermost/mattermost/server/public` in the project and check the version shown.\n- Search go.mod and go.sum for `github.com/mattermost/mattermost/server/public`.","fix":"- github.com/mattermost/mattermost/server/public: `v0.1.22`","status":"open","published_at":"2026-06-26T14:17:03+00:00","first_seen_at":"2026-11-03T22:07:22+00:00","triaged_at":"2026-11-03T22:07:52+00:00","updated_at":"2026-11-03T23:15:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T22:07:52Z","model":"claude-haiku-5-5","output":{"fix":"- github.com/mattermost/mattermost/server/public: `v0.1.22`","reach":"network","title":"Mattermost Go client: path traversal in API route construction","impact":"medium","summary":"The Mattermost Go module github.com/mattermost/mattermost/server/public before v0.1.22 does not validate path parameters when building API route paths. A crafted ID containing path traversal components can redirect API calls to unintended endpoints.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","mattermost","api-clients"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"API calls are redirected to unintended server endpoints","analyst_note":"","how_to_check":"- Run `go list -m github.com/mattermost/mattermost/server/public` in the project and check the version shown.\n- Search go.mod and go.sum for `github.com/mattermost/mattermost/server/public`.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-ids-only","not-using-module"],"who_is_affected":"Projects that import the Mattermost Go client module and pass user-supplied or external IDs into its API calls are the exposed ones. Code that only uses the module with fixed, trusted IDs is less likely to be reached by the crafted input. The sources do not describe which specific client methods are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4260,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00532':109C '-13426':14A,22A '-2025':108C '-2026':13A,21A '-22':30B '/mattermost/mattermost/server/public':3A,25A,40B,73C '4qmm':19A '72v2':17A 'advisori':105C 'allow':87C 'api':9A,27B,50B,62B,83C,92C 'api-cli':26B 'attack':89C 'build':49B 'call':63B,93C 'client':28B 'compon':59B,103C 'construct':11A,82C 'contain':56B,100C 'craft':54B,98C 'cve':12A,20A 'cwe':29B 'endpoint':66B,96C 'fail':76C 'ghsa':16A 'ghsa-72v2-v53v-4qmm':15A 'github.com':2A,24A,39B,72C 'github.com/mattermost/mattermost/server/public':1A,23A,38B,71C 'go':31B,36B,69C 'id':55B,99C,106C 'mattermost':32B,35B,68C,104C 'mmsa':107C 'modul':37B,70C 'packag':33B 'paramet':47B,80C 'path':6A,46B,52B,57B,79C,85C,101C 'redirect':61B,91C 'rout':10A,51B,84C 'travers':7A,58B,102C 'unintend':65B,95C 'v0.1.22':42B,75C 'v53v':18A 'valid':45B,78C 'version':74C 'via':97C 'vulner':4A","nicknames":[],"mitigations":[],"who_affected":"Projects that import the Mattermost Go client module and pass user-supplied or external IDs into its API calls are the exposed ones. Code that only uses the module with fixed, trusted IDs is less likely to be reached by the crafted input. The sources do not describe which specific client methods are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcommattermostmattermostserverpublic"],"ptokens":["com","github","mattermost","public","server"],"labels":["apiclients","cwe22","go","mattermost","medium","package"],"campaign_type":null,"first_public_at":"2026-06-26T14:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-72v2-v53v-4qmm","url":"https://github.com/advisories/GHSA-72v2-v53v-4qmm","severity":"medium","published_at":"2026-06-26T15:32:13+00:00","modified_at":"2026-11-03T22:04:55+00:00","first_seen_at":"2026-11-03T22:07:22+00:00","fetched_at":"2026-11-03T22:12:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-13426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13426","severity":null,"published_at":"2026-06-26T14:17:03+00:00","modified_at":"2026-10-25T22:10:00+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","fetched_at":"2026-11-03T23:15:09+00:00","note":null}],"documents":[{"id":61065,"url":"https://github.com/mattermost/mattermost/pull/34499","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61066,"url":"https://github.com/mattermost/mattermost/pull/39305","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61067,"url":"https://github.com/mattermost/mattermost/commit/2b075c9b74effbb56f3769f1bdec161eef4c6808","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61068,"url":"https://github.com/mattermost/mattermost/commit/64c16ff0ea7f455ee648bfe906407def1274fbd3","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61069,"url":"https://github.com/mattermost/mattermost/releases/tag/server/public/v0.1.22","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}