EUVD-2026-30590
GHSA-j76w-p754-g2w7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630
AnalysisAI
Client-side denial-of-service in Mattermost allows remote attackers to crash user browsers via maliciously crafted SVG files embedded in OpenGraph metadata or Markdown images. The vulnerability affects Mattermost Server versions 11.5.0-11.5.1, 10.11.0-10.11.13, and 11.4.0-11.4.3, where the server fails to validate proxied image response bodies. Attackers exploit this by serving SVG files with misleading Content-Type headers (e.g., image/png) that bypass validation, causing resource exhaustion when rendered in victim browsers. CVSS rates this 4.3 (Medium) with network attack vector requiring user interaction, while EPSS data is not available. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Technical ContextAI
Mattermost's image proxy feature retrieves and serves externally linked images to prevent direct client connections to untrusted origins. The affected versions (CPE: cpe:2.3:a:mattermost:mattermost) fail to validate response bodies from proxied image requests, trusting only the HTTP Content-Type header. This vulnerability exploits CWE-754 (Improper Check for Unusual or Exceptional Conditions) by allowing SVG files to bypass validation when served with non-SVG MIME types. SVG files can contain embedded scripts, animations, or recursive elements that consume excessive browser resources. When embedded via OpenGraph og:image tags (rendered in link previews) or Markdown image syntax, the malicious SVG renders in victim browsers despite appearing as a benign image type. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low attack complexity from a network position with no authentication required, but user interaction is necessary to trigger rendering.
RemediationAI
Upgrade to patched Mattermost Server versions released after the affected branches (specific patched versions: 11.5.2 or later for 11.5.x branch, 10.11.14 or later for 10.11.x branch, 11.4.4 or later for 11.4.x branch-verify exact fix versions at https://mattermost.com/security-updates). As a temporary mitigation, administrators can disable the image proxy feature entirely, though this forces client browsers to connect directly to external image sources, reducing privacy and potentially exposing internal IP addresses. Alternatively, implement Content Security Policy (CSP) headers that restrict SVG rendering by setting 'img-src' directives to exclude 'data:' URIs and validate image types, though this may break legitimate SVG usage in channels. Network-level controls blocking SVG MIME types at the proxy or load balancer can reduce risk but may cause false positives. Monitor Mattermost logs for unusual image proxy requests with Content-Type mismatches. Review channel posting permissions to limit untrusted users' ability to embed external images.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today