What is the CVSS score of CVE-2026-6957?

CVE-2026-6957 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost Plugins are affected by CVE-2026-6957?

Mattermost Plugins versions 1.1.5 and earlier are vulnerable to arbitrary file writes when federated with untrusted server instances, potentially allowing compromised federated partners to inject…

How to fix or mitigate CVE-2026-6957?

Within 24 hours: identify all Mattermost servers running Plugins version 1.1.5 or earlier; audit current federation relationships and disable connections to untrusted peers; restrict administrative account usage to essential personnel. Within 7 days: implement network segmentation to isolate federated Mattermost connections from critical infrastructure; deploy file integrity monitoring on affected servers; audit administrative activities on federated instances over the past 90 days. Within 30 days: monitor vendor security advisories for patch availability; prepare upgrade procedures for rapid deployment when patches are released; conduct comprehensive security assessment of Mattermost federation configuration.

Mattermost Plugins CVE-2026-6957

EUVD-2026-32523 HIGH

Path Traversal (CWE-22)

2026-05-27 responsibledisclosure@mattermost.com

GHSA-x7w4-j7hv-94wg

Mattermost Path Traversal

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:08 vuln.today

DescriptionCVE.org

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore via a malicious filename delivered through the shared-channel attachment sync protocol. Mattermost Advisory ID: MMSA-2026-00659

AnalysisAI

Arbitrary file write in Mattermost Plugins (versions ≤1.1.5) lets an administrator of a remote, federated Mattermost server plant files at attacker-chosen paths inside the target server's filestore by supplying a malicious, unsanitized filename through the shared-channel attachment sync protocol. The flaw stems from CWE-22 path traversal in the export-path construction logic and carries CVSS 8.0 with a changed scope, reflecting that a compromised or hostile federation peer can affect resources beyond the plugin's intended boundary. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none' but technical impact as 'total'.

Technical ContextAI

Mattermost supports cross-server collaboration through 'shared channels,' a federation feature in which an attachment sync protocol transfers files (and their metadata, including filenames) between trusting Mattermost instances. The affected component is the Mattermost Plugins bundle at versions ≤1.1.5, which receives these federated filenames and uses them directly to build the destination path when writing the synced attachment into the local filestore. Because the filename is taken from a remote, untrusted peer and not sanitized, classic CWE-22 path traversal sequences (e.g., '../') in the filename break out of the intended export directory. The CVSS scope-changed (S:C) rating indicates the write can reach filestore locations outside the plugin's own security authority, magnifying the integrity impact.

RemediationAI

Upgrade the Mattermost Plugins bundle to a release later than 1.1.5; an exact fixed version is not stated in the available data, so consult Mattermost advisory MMSA-2026-00659 via https://mattermost.com/security-updates to confirm the patched build (patch available per vendor advisory; released patched version not independently confirmed). Until patched, the most direct compensating control is to disable shared channels / federation, or to break federation trust with any server you do not fully control - this eliminates the attack path but also removes cross-server collaboration. If federation must remain enabled, restrict it to a vetted allowlist of trusted partner servers and monitor the filestore for files written outside expected attachment directories or containing traversal patterns; this reduces exposure but does not fix the underlying parsing flaw. Avoid running affected plugin versions on servers that peer with untrusted or externally administered Mattermost instances.