PT-2026-28421 · Mattermost · Mattermost

Mufeedvh · Publicado 2026-03-26 · Atualizado 2026-03-27 · CVE-2026-3112

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.11 Mattermost versions 11.2.x through 11.2.3 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0

Description The software does not properly validate file target paths for Advanced Logging. This allows system administrators to potentially read arbitrary host files through a malicious AdvancedLoggingJSON configuration when generating support packets.

Recommendations Mattermost versions 10.11.x through 10.11.11 should be updated. Mattermost versions 11.2.x through 11.2.3 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-3112

GHSA-3MW5-466Q-295Q

Produtos afetados

Mattermost

Referências · 7

• https://github.com/mattermost/mattermost · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3112 · Nota de Segurança
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3mw5-466q-295q · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3112 · Nota
• https://twitter.com/infoflowcloud/status/2037515586339553598 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037513439933870251 · Publicação no Twitter