CVE-2026-4858CWE-22

Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

High · published May 21, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-21T08:12Z
EPSS history
Timeline
  • 21 MAY 08:12Z
    Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
    cvelistv5