PT-2026-27810 · Mattermost · Mattermost

Mk7120 · Publicado 2026-03-25 · Atualizado 2026-03-25 · CVE-2026-20719

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.4.0 and earlier Mattermost versions 11.3.1 and earlier Mattermost versions 11.2.3 and earlier Mattermost versions 10.11.11 and earlier

Description The software does not properly prevent the rendering of external Scalable Vector Graphics (SVGs) within link embeds. This allows unauthenticated users to cause the Mattermost web application and desktop application to crash by creating an issue or pull request on GitHub.

Recommendations Update Mattermost to a version later than 11.4.0. Update Mattermost to a version later than 11.3.1. Update Mattermost to a version later than 11.2.3. Update Mattermost to a version later than 10.11.11.

Correção

DoS

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

CVE-2026-20719

GHSA-86VC-MG26-FJ6X

Produtos afetados

Mattermost

Referências · 6

• https://github.com/mattermost/mattermost · Nota
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-20719 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20719 · Nota
• https://osv.dev/vulnerability/GHSA-86vc-mg26-fj6x · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036911846884770087 · Publicação no Twitter