CVE-2026-3495CWE-79cross-site-scripting

CVE-2026-3495

Low · published May 18, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-18T12:16Z
Affected products (2)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.1410.11.14
mattermost/mattermost_server≥ 11.5.0, < 11.5.211.5.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 18 MAY 06:58Z
    Unescaped variables during error page composition
    cvelistv5