EUVD-2026-16238Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost Advisory ID: MMSA-2025-00562
AnalysisAI
Mattermost Advanced Logging configuration fails to properly validate file target paths, allowing authenticated system administrators to read arbitrary files from the host system during support packet generation. The vulnerability affects Mattermost versions 11.4.0 and earlier in the 11.4.x line, 11.3.1 and earlier in the 11.3.x line, 11.2.3 and earlier in the 11.2.x line, and 10.11.11 and earlier in the 10.11.x line. An authenticated administrator with access to Advanced Logging JSON configuration can craft a malicious configuration to traverse the filesystem and extract sensitive host files through the support packet mechanism. No public exploit code has been identified at time of analysis, though exploitation requires administrative privileges and is not automatable according to CISA SSVC assessment.
Technical ContextAI
The vulnerability is a path traversal vulnerability (CWE-22) in Mattermost's Advanced Logging subsystem, specifically affecting how the application processes file target paths when generating support packets. Mattermost (cpe:2.3:a:mattermost:mattermost) uses Advanced Logging JSON configuration to define logging outputs, including file-based targets. The vulnerable code fails to implement proper input validation or path normalization before using administrator-supplied file paths in logging operations, allowing directory traversal sequences (such as '../') to bypass intended sandboxing. The support packet generation feature leverages this configuration without re-validating paths, creating a window for unauthorized file access when a malicious AdvancedLoggingJSON configuration is processed.
RemediationAI
Upgrade Mattermost to a patched version released after the vulnerable releases identified in MMSA-2025-00562 (consult https://mattermost.com/security-updates for the specific minimum patched version for each branch). Until patching can be completed, restrict access to Advanced Logging configuration settings to only trusted system administrators, disable or audit Advanced Logging JSON configuration if not actively required, and implement filesystem-level access controls to limit the scope of files that the Mattermost process can read. Network segmentation to limit support packet download functionality to internal administrative channels reduces exposure window. Additionally, audit existing Advanced Logging configurations for suspicious file path entries and review support packet generation logs for evidence of path traversal attempts.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Debian
Bug #823556| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today