EUVD-2026-49852
GHSA-rxgw-2f9c-c2hh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin credentials via phishing or credential compromise
-
DeliveryAuthenticate to Mattermost as admin with SAML system-console write access
-
ExploitSend crafted path traversal request to the file deletion endpoint
-
ExecutionDelete configuration or system files outside the restricted directory
-
ImpactCause denial of service or availability loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be an authenticated administrator with SAML system-console write permissions. SAML authentication must be configured in the Mattermost instance, and the admin must have been granted explicit write access to the system console’s SAML settings. Without these exact privileges, the endpoint is not accessible, and the flaw cannot be exploited. |
| Impact | The CVSS 3.1 base score is 5.5 (Medium), with a vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H, reflecting a network-accessible vulnerability that demands high privileges (admin with SAML write), no user interaction, and primarily affects availability (high) with a lesser integrity impact (low). No EPSS data is available, and it is not listed in CISA KEV, suggesting no known active exploitation. A public proof of concept is not reported. The required SAML configuration and high-privilege requirement substantially limit the attack surface, making this a lower real-world risk despite the medium CVSS rating. There is no conflicting signal: the vector correctly aligns with the description’s preconditions. |
| Exploit ScenarioDerived | An attacker who compromises admin credentials with SAML system-console write permissions could craft a malicious request to the vulnerable file deletion endpoint, using path traversal sequences to delete critical server files. This could disrupt service availability by removing configuration files or application data stored outside the intended directory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact. Affected versions include 10.11.x through 10.11.20, 11.6.x through 11.6.5, 11.7.x through 11.7.3, and 11.8.0. No public exploit is identified at time of analysis, but the required high privileges limit the immediate risk.
RemediationAI
The vendor advises upgrading to a patched version; exact fixed versions are not specified in the available data, so consult the official Mattermost security advisory at https://mattermost.com/security-updates for the appropriate upgrade. As an immediate workaround, restrict SAML system-console write permissions to a minimal set of trusted administrators, and monitor access to the remove file endpoint for suspicious activity. Note that the workaround does not eliminate the underlying vulnerability, so patching remains essential.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic path traversal (CWE-22) in the Mattermost server's remove file endpoint, which fails to properly sanitize user-supplied file paths before deletion. The affected product, identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, is a self-hosted collaboration platform. The flaw lies in the backend file-handling logic that does not restrict the path within the configuration directory, allowing an attacker to escape with directory traversal sequences. The attack requires SAML system-console write permissions, a feature used for managing server configuration files in SAML-authenticated environments.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
High privileges (admin with SAML write) required; network vector, no user interaction, limited integrity impact, high availability impact.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
DescriptionCVE.org
Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Exploit-DB