What is the CVSS score of CVE-2026-7521?

CVE-2026-7521 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Mattermost CVE-2026-7521

Q: Which versions of Mattermost are affected by CVE-2026-7521?

Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact.

EUVD-2026-49852 MEDIUM

Path Traversal (CWE-22)

2026-07-28 Mattermost

GHSA-rxgw-2f9c-c2hh

Path Traversal Mattermost

5.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

5.5 MEDIUM

High privileges (admin with SAML write) required; network vector, no user interaction, limited integrity impact, high availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:18 vuln.today

DescriptionCVE.org

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666

AnalysisAI

Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact. Affected versions include 10.11.x through 10.11.20, 11.6.x through 11.6.5, 11.7.x through 11.7.3, and 11.8.0. No public exploit is identified at time of analysis, but the required high privileges limit the immediate risk.

Technical ContextAI

The vulnerability is a classic path traversal (CWE-22) in the Mattermost server's remove file endpoint, which fails to properly sanitize user-supplied file paths before deletion. The affected product, identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, is a self-hosted collaboration platform. The flaw lies in the backend file-handling logic that does not restrict the path within the configuration directory, allowing an attacker to escape with directory traversal sequences. The attack requires SAML system-console write permissions, a feature used for managing server configuration files in SAML-authenticated environments.

RemediationAI

The vendor advises upgrading to a patched version; exact fixed versions are not specified in the available data, so consult the official Mattermost security advisory at https://mattermost.com/security-updates for the appropriate upgrade. As an immediate workaround, restrict SAML system-console write permissions to a minimal set of trusted administrators, and monitor access to the remove file endpoint for suspicious activity. Note that the workaround does not eliminate the underlying vulnerability, so patching remains essential.