PT-2026-41349 · Mattermost · Mattermost+1

Mk7120 · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-4054

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Mattermost versions 11.4.0 through 11.4.3

Description Failure to validate the response body of proxied images allows a remote attacker to cause a client-side Denial of Service (DoS). This occurs when an SVG file is served from an attacker-controlled origin using a non-SVG Content-Type header, such as 'image/png', and is embedded within an og:image meta tag or a Markdown image link.

Recommendations Update versions 11.5.0 through 11.5.1 to a newer version. Update versions 10.11.0 through 10.11.13 to a newer version. Update versions 11.4.0 through 11.4.3 to a newer version.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-4054

Affected Products

Mattermost

Mattermost Server

References · 3

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4054 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4054 · Note