What is the CVSS score of CVE-2026-6961?

CVE-2026-6961 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-6961?

Mattermost versions 10.11.x through 11.6.1 contain an arbitrary file write vulnerability in federated file synchronization that allows attackers controlling external Mattermost peers to write files…. A patch is available.

How to fix or mitigate CVE-2026-6961?

Within 24 hours: identify all Mattermost instances running affected versions (10.11.x ≤ 10.11.16, 11.5.x ≤ 11.5.4, 11.6.x ≤ 11.6.1) and audit federated peer configurations. Within 7 days: disable federated shared channels if operationally feasible, or restrict federation to organization-controlled Mattermost servers only via allowlist. Within 30 days: monitor vendor security advisories for patch release and schedule upgrade to a patched version once available.

Mattermost CVE-2026-6961

EUVD-2026-36504 HIGH

Path Traversal (CWE-22)

2026-06-12 Mattermost

GHSA-8qq9-cqj8-82w4

Path Traversal Mattermost

7.6

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L

vuln.today AI

7.6 HIGH

Network-reachable file sync (AV:N/AC:L); requires administrative control of a federated peer (PR:H); arbitrary file write crosses the filestore trust boundary (S:C) yielding high integrity and low availability impact with no direct confidentiality loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 17:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field.. Mattermost Advisory ID: MMSA-2026-00661

AnalysisAI

Arbitrary file write in Mattermost via path traversal affects versions 11.6.x ≤ 11.6.1, 11.5.x ≤ 11.5.4, and 10.11.x ≤ 10.11.15/10.11.16 when shared channels with federated peers are in use. An attacker who controls a federated Mattermost server can supply crafted FileInfo.Name values during file sync to write files to arbitrary locations in the target server's filestore. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Mattermost's shared channels feature lets multiple Mattermost servers federate and synchronize messages and attachments across organizational boundaries. During file sync, the receiving server consumes a FileInfo structure (including a Name field) sent by the peer and uses it to persist the file on the local filestore. The flaw is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - the Name field is trusted rather than sanitized for '..' / absolute path components, so traversal sequences resolve outside the intended attachment directory. The affected component is the Mattermost server application identified by cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*.

RemediationAI

Patch available per vendor advisory MMSA-2026-00661 (https://mattermost.com/security-updates) - upgrade to a fixed release above 11.6.1, 11.5.4, or 10.11.16 as listed by Mattermost; exact fix versions should be confirmed against that advisory before deployment. As a compensating control until patching, disable the shared channels feature or remove federation/trust with any peer servers not under your direct administrative control, accepting the trade-off that cross-organization collaboration channels will stop syncing. If federation must remain on, restrict outbound and inbound shared-channel connections at the network layer to only known partner servers and monitor filestore directories for unexpected writes outside the configured attachments path.