---
id: "CVE-2026-13426"
kind: "vulnerability"
aliases: ["CVE-2026-13426", "GHSA-72v2-v53v-4qmm"]
title: "github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction"
severity: "medium"
cvss: 5.4
epss: 0.00291
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/mattermost/mattermost/server/public", "fixed": ["0.1.22"], "affected": "< 0.1.22", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["api-clients", "cwe-22", "go", "mattermost", "package"]
not_affected_if: ["fixed-ids-only", "not-using-module"]
published_at: "2026-06-26T14:17:03+00:00"
first_seen_at: "2026-11-03T22:07:22+00:00"
updated_at: "2026-11-03T23:15:09+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-72v2-v53v-4qmm", "first_seen_at": "2026-11-03T22:07:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13426", "first_seen_at": "2026-11-03T23:15:09+00:00"}]
---

# github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction

The Mattermost Go module github.com/mattermost/mattermost/server/public before v0.1.22 does not validate path parameters when building API route paths. A crafted ID containing path traversal components can redirect API calls to unintended endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/mattermost/mattermost/server/public affected < 0.1.22 fixed 0.1.22

## How to check

- Run `go list -m github.com/mattermost/mattermost/server/public` in the project and check the version shown.
- Search go.mod and go.sum for `github.com/mattermost/mattermost/server/public`.

## Fix

- github.com/mattermost/mattermost/server/public: `v0.1.22`

## Timeline

- 2026-11-03T22:07:22+00:00 ghsa https://github.com/advisories/GHSA-72v2-v53v-4qmm
- 2026-11-03T23:15:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13426

## Documents

- [fix] Patch: github.com https://github.com/mattermost/mattermost/pull/34499
- [fix] Patch: github.com https://github.com/mattermost/mattermost/pull/39305
- [fix] Patch: github.com https://github.com/mattermost/mattermost/commit/2b075c9b74effbb56f3769f1bdec161eef4c6808
- [fix] Patch: github.com https://github.com/mattermost/mattermost/commit/64c16ff0ea7f455ee648bfe906407def1274fbd3
- [fix] Release: github.com https://github.com/mattermost/mattermost/releases/tag/server/public/v0.1.22

## From the sources

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_