PT-2026-42439 · Mattermost · Mattermost

Daw10 · Published 2026-05-21 · Updated 2026-06-25 · CVE-2026-4858

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14

Description An authenticated user can perform path traversal in the integration action URL. This occurs because the software fails to properly validate the integration URL, allowing the user to call an arbitrary API using the system admin Mattermost authentication token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-09267

CVE-2026-4858

GHSA-C4R7-J7PP-R8MP

GO-2026-5311

Affected Products

Mattermost

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4858.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4858 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5311 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c4r7-j7pp-r8mp · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09267 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4858 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-42439 · Note
• https://github.com/advisories/GHSA-c4r7-j7pp-r8mp · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4858 · Note
• https://t.me/CVEtracker/54479 · Telegram Post
• https://threataft.com/articles/mattermost-cve-2026-4858-path-traversal-api-takeover · Note
• https://twitter.com/CVEnew/status/2057407755900571759 · Twitter Post