What is the CVSS score of CVE-2026-3112?

CVE-2026-3112 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-3112?

CVE-2026-3112 presents notable security risk, a path traversal vulnerability rated CVSS 6.8. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-3112?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Mattermost CVE-2026-3112

EUVD-2026-16238 MEDIUM

Path Traversal (CWE-22)

2026-03-26 Mattermost

Path Traversal Mattermost

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16238

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:29 nvd

MEDIUM 6.8

DescriptionCVE.org

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost Advisory ID: MMSA-2025-00562

AnalysisAI

Mattermost Advanced Logging configuration fails to properly validate file target paths, allowing authenticated system administrators to read arbitrary files from the host system during support packet generation. The vulnerability affects Mattermost versions 11.4.0 and earlier in the 11.4.x line, 11.3.1 and earlier in the 11.3.x line, 11.2.3 and earlier in the 11.2.x line, and 10.11.11 and earlier in the 10.11.x line. An authenticated administrator with access to Advanced Logging JSON configuration can craft a malicious configuration to traverse the filesystem and extract sensitive host files through the support packet mechanism. No public exploit code has been identified at time of analysis, though exploitation requires administrative privileges and is not automatable according to CISA SSVC assessment.

Technical ContextAI

The vulnerability is a path traversal vulnerability (CWE-22) in Mattermost's Advanced Logging subsystem, specifically affecting how the application processes file target paths when generating support packets. Mattermost (cpe:2.3:a:mattermost:mattermost) uses Advanced Logging JSON configuration to define logging outputs, including file-based targets. The vulnerable code fails to implement proper input validation or path normalization before using administrator-supplied file paths in logging operations, allowing directory traversal sequences (such as '../') to bypass intended sandboxing. The support packet generation feature leverages this configuration without re-validating paths, creating a window for unauthorized file access when a malicious AdvancedLoggingJSON configuration is processed.

RemediationAI

Upgrade Mattermost to a patched version released after the vulnerable releases identified in MMSA-2025-00562 (consult https://mattermost.com/security-updates for the specific minimum patched version for each branch). Until patching can be completed, restrict access to Advanced Logging configuration settings to only trusted system administrators, disable or audit Advanced Logging JSON configuration if not actively required, and implement filesystem-level access controls to limit the scope of files that the Mattermost process can read. Network segmentation to limit support packet download functionality to internal administrative channels reduces exposure window. Additionally, audit existing Advanced Logging configurations for suspicious file path entries and review support packet generation logs for evidence of path traversal attempts.