CVE-2025-13523: GO-2026-4456 - Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/matte

CVE-2025-13523 · Severity: low · CVSS 3.1 · Published 2026-02-17

Technologies: github.com/mattermost/mattermost-plugin-confluence (Go). Vendors: Go.

Executive brief

Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/mattermost-plugin-confluence

Affected products

Go github.com/mattermost/mattermost-plugin-confluence

Related threats

GO-2025-3872 - Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence
GO-2025-3862 - Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
GO-2025-3875 - Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence
GO-2025-3871 - Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
GO-2025-3867 - Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence