CVE-2026-13426CWE-22

Client4 fails to validate path parameters

Medium · published June 26, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-26T13:47Z
EPSS history
Timeline
  • 26 JUN 13:47Z
    Client4 fails to validate path parameters
    cvelistv5