What is the CVSS score of EUVD-2026-39661?

EUVD-2026-39661 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Mattermost EUVD-2026-39661

| CVE-2026-13426 MEDIUM

Path Traversal (CWE-22)

2026-06-26 responsibledisclosure@mattermost.com

GHSA-72v2-v53v-4qmm

Path Traversal Mattermost

5.4

CVSS 3.1 · Vendor: mattermost

Severity by source

Vendor (mattermost) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable by any authenticated low-privilege user; path traversal yields bounded read/write at unintended endpoints, no scope change or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mattermost).

CVSS VectorVendor: mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 14:30 vuln.today

DescriptionCVE.org

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532

AnalysisAI

Path traversal in Mattermost's Go server module allows authenticated remote attackers to redirect API calls to unintended endpoints by embedding path traversal components (e.g., '../') within crafted ID parameters. The affected library is github.com/mattermost/mattermost/server/public versions prior to v0.1.22, which fails to sanitize path parameters before constructing API route paths. Exploitation yields limited confidentiality and integrity impact (CVSS 5.4 Medium); no public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Go module github.com/mattermost/mattermost/server/public, which provides shared server-side primitives for the Mattermost collaboration platform. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause: when this library constructs API route paths by interpolating caller-supplied ID values, it does not validate or sanitize those values for path traversal sequences such as '../' or URL-encoded equivalents. As a result, an attacker-controlled ID can escape the intended API namespace and cause the server to route the request to a different, unintended API endpoint. This is a server-side routing confusion issue rather than a traditional filesystem traversal - the traversal occurs within the HTTP routing layer, not directly against the filesystem.

RemediationAI

Upgrade the github.com/mattermost/mattermost/server/public Go module to v0.1.22 or later, which introduces proper validation of path parameters prior to API route construction. Organizations running Mattermost server should update to the corresponding Mattermost server release that pulls in this fixed module version, as detailed in the vendor security updates page at https://mattermost.com/security-updates. If an immediate upgrade is not feasible, a compensating control is to enforce strict network-layer access controls so that only trusted, authenticated users with least-privilege roles can reach API endpoints - this does not eliminate the flaw but reduces the pool of potential attackers. Mattermost administrators should also audit API gateway or reverse proxy configurations to restrict unexpected path patterns (e.g., requests containing '../' sequences) at the ingress layer, though this control may be bypassable via encoding variants. Note that no exact patched Mattermost server version number is independently confirmed in the available reference data beyond the Go module version v0.1.22.