PT-2026-28421 · Mattermost · Mattermost

Mufeedvh · Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-3112

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.11 Mattermost versions 11.2.x through 11.2.3 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0

Description The software does not properly validate file target paths for Advanced Logging. This allows system administrators to potentially read arbitrary host files through a malicious AdvancedLoggingJSON configuration when generating support packets.

Recommendations Mattermost versions 10.11.x through 10.11.11 should be updated. Mattermost versions 11.2.x through 11.2.3 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3112

GHSA-3MW5-466Q-295Q

Affected Products

Mattermost

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3112 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3mw5-466q-295q · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3112 · Note
• https://twitter.com/infoflowcloud/status/2037515586339553598 · Twitter Post
• https://twitter.com/CVEnew/status/2037513439933870251 · Twitter Post