What is the CVSS score of EUVD-2026-15485?

EUVD-2026-15485 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by EUVD-2026-15485?

CVE-2026-20719 presents moderate security risk rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-15485?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost EUVD-2026-15485

| CVE-2026-20719 MEDIUM

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-03-25 Mattermost

GHSA-86vc-mg26-fj6x

Denial Of Service Mattermost

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15485

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:30 nvd

MEDIUM 4.3

DescriptionCVE.org

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595

AnalysisAI

Mattermost fails to properly sanitize external SVG rendering in link embeds, allowing unauthenticated users to trigger denial-of-service conditions in both web and desktop applications. An attacker can create a malicious GitHub issue or pull request containing a crafted external SVG that crashes the Mattermost webapp and desktop client when the link is embedded. This vulnerability affects Mattermost versions 11.4.0 and below, 11.3.1 and below, 11.2.3 and below, and 10.11.11 and below, with a CVSS score of 4.3 indicating low-to-moderate severity focused on availability impact rather than confidentiality or integrity.

Technical ContextAI

The vulnerability stems from CWE-754 (Improper Check for Unusual or Exceptional Conditions), specifically inadequate input validation and output encoding when rendering external SVG resources in link embeds. Mattermost's link embedding functionality fails to properly validate or sanitize SVG content from external sources before rendering it in the client-side application. SVG files are XML-based vector graphics that can contain complex nested structures, scripts, or malformed data; without proper bounds checking and exception handling, rendering these can consume excessive resources or trigger unhandled exceptions. The affected CPE (cpe:2.3:a:mattermost:mattermost) indicates the core Mattermost product across multiple major versions is vulnerable, affecting both the web UI and desktop applications that share common rendering logic.

RemediationAI

Immediately upgrade Mattermost to patched versions: 11.4.1 or later for the 11.4.x branch, 11.3.2 or later for the 11.3.x branch, 11.2.4 or later for the 11.2.x branch, and 10.11.12 or later for the 10.11.x branch. See the Mattermost security advisory at https://mattermost.com/security-updates for exact patch availability and download links. As an interim mitigation, disable GitHub link embedding or restrict Mattermost's ability to fetch and render external SVG content by blocking egress to external domains at the network level, though this may reduce functionality. Additionally, restrict message creation and link posting permissions to authenticated, trusted users only if your deployment allows such controls, reducing the attack surface for unauthenticated abuse.