PT-2026-28421 · Mattermost · Mattermost

Mufeedvh · CVE-2026-3112 · Published 2026-03-26 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.11 Mattermost versions 11.2.x through 11.2.3 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0

Description The software does not properly validate file target paths for Advanced Logging. This allows system administrators to potentially read arbitrary host files through a malicious AdvancedLoggingJSON configuration when generating support packets.

Recommendations Mattermost versions 10.11.x through 10.11.11 should be updated. Mattermost versions 11.2.x through 11.2.3 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

Exploit

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3112

GHSA-3MW5-466Q-295Q

GO-2026-5092

Affected Products

Mattermost

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3112.json · Exploit
• https://osv.dev/vulnerability/GHSA-3mw5-466q-295q · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3112 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3112 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/advisories/GHSA-3mw5-466q-295q · Note
• https://twitter.com/CVEnew/status/2037513439933870251 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3112 · Note
• https://twitter.com/infoflowcloud/status/2037515586339553598 · Twitter Post