PT-2026-28419 · Mattermost · Mattermost

Winfunc

·

CVE-2026-3108

·

Published

2026-03-26

·

Updated

2026-07-30

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0
Description The software does not properly sanitize user-controlled post content in the terminal output of mmctl commands. This allows attackers to manipulate administrator terminals through crafted messages containing ANSI and OSC escape sequences. These sequences can enable screen manipulation, display fake prompts, and hijack the clipboard. The Mattermost Advisory ID for this issue is MMSA-2026-00599.
Recommendations Update Mattermost to a version beyond 10.11.10. Update Mattermost to a version beyond 11.2.2. Update Mattermost to a version beyond 11.3.1. Update Mattermost to a version beyond 11.4.0.

Exploit

Fix

DoS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-3108
GHSA-3439-VQGJ-2GCF
GO-2026-5067
OPENSUSE-SU-2026:21483-1

Affected Products

Mattermost