CVE-2026-14298CWE-409

CVE-2026-14298

Medium · published August 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.2th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-08-13T13:17Z
Affected products (4)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.2310.11.23
mattermost/mattermost_server≥ 11.7.0, < 11.7.811.7.8
mattermost/mattermost_server≥ 11.8.0, < 11.8.511.8.5
mattermost/mattermost_server≥ 11.9.0, < 11.9.111.9.1
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 13 AUG 08:03Z
    Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
    cvelistv5