PT-2020-8458 · Mattermost · Mattermost Server

Published 2020-06-19 · Updated 2026-03-03 · CVE-2017-18912

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7

Description: An issue was discovered that allows an attacker to specify a full pathname of a log file.

Recommendations: For versions prior to 3.8.2, update to version 3.8.2 or later. For versions prior to 3.7.5, update to version 3.7.5 or later. For versions prior to 3.6.7, update to version 3.6.7 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-18912

GHSA-M2CH-X2Q7-2284

GO-2026-4487

SUSE-SU-2026:0757-1

Affected Products

Mattermost Server

References · 115

• https://nvd.nist.gov/vuln/detail/CVE-2017-18912 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18912 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4487 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2ch-x2q7-2284 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/0b5c0794fdcbb551c1233dcdfbdf5c7deb585fd6 · Note
• https://suse.com/security/cve/CVE-2025-64111 · Note
• https://suse.com/security/cve/CVE-2026-0998 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://suse.com/security/cve/CVE-2026-22892 · Note
• https://suse.com/security/cve/CVE-2026-21434 · Note
• https://suse.com/security/cve/CVE-2026-25760 · Note
• https://suse.com/security/cve/CVE-2025-13821 · Note