PT-2026-41645 · Mattermost · Mattermost

Juho Forsén

·

CVE-2026-6340

·

Published

2026-05-18

·

Updated

2026-07-30

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Mattermost versions 11.4.0 through 11.4.3
Description An authenticated attacker can cause server memory exhaustion and denial of service by uploading a specially crafted 7zip file containing excessive folder declarations. This occurs because the software fails to validate the 7zip archive structure before processing it.
Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13. Update Mattermost versions 11.4.0 through 11.4.3 to a version newer than 11.4.3.

Exploit

Fix

DoS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-6340
GHSA-CJM8-JXPW-G43M
GO-2026-5325
OPENSUSE-SU-2026:21483-1

Affected Products

Mattermost