PT-2026-41645 · Mattermost · Mattermost

Juho Forsén · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-6340

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Mattermost versions 11.4.0 through 11.4.3

Description An authenticated attacker can cause server memory exhaustion and denial of service by uploading a specially crafted 7zip file containing excessive folder declarations. This occurs because the software fails to validate the 7zip archive structure before processing it.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13. Update Mattermost versions 11.4.0 through 11.4.3 to a version newer than 11.4.3.

Fix

DoS

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-6340

GHSA-CJM8-JXPW-G43M

Affected Products

Mattermost

References · 8

• https://osv.dev/vulnerability/GHSA-cjm8-jxpw-g43m · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6340 · Security Note
• https://github.com/mattermost/mattermost/commit/fb11968f8798925c7b75711025bc5f991124ba26 · Note
• https://github.com/mattermost/mattermost · Note
• https://t.me/CVEtracker/54106 · Telegram Post
• https://twitter.com/CVEarity/status/2056409836284420380 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6340 · Note