Vulnerability GHSA-72v2-v53v-4qmm
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 26, 2026 at 03:32 PM UTC
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
v0.0.1 - v0.1.21
v0.0.1 - v0.1.21
Summary
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
Details
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 03:32 PM UTC
Fixed (v0.1.22)
9 months ago
January 30, 2026 at 04:03 PM UTC
Last Modified
12 hours ago
November 03, 2026 at 10:15 PM UTC