Executive brief
Mattermost, a collaboration and messaging platform, is affected by a vulnerability in how it handles image previews. An attacker can send a specially crafted link or image tag that, when viewed by a user, causes their Mattermost client to freeze or crash. This results in a temporary disruption of service for the affected user but does not compromise personal data or server integrity.
Technical details
Mattermost Server fails to properly validate the response body of images fetched via its proxy. A remote attacker can exploit this by hosting a malicious SVG file on an attacker-controlled server and serving it with a misleading Content-Type header (such as image/png). When this file is embedded in an 'og:image' meta tag or a Markdown image link within a Mattermost channel, the client-side application attempts to process the file, leading to a denial of service (DoS) on the victim's machine. The vulnerability is rooted in improper check for unusual conditions (CWE-754) during image proxying. Patches are available in versions 10.11.14, 11.4.4, and 11.5.2.
Affected products
- Mattermost Mattermost Server 10.11.0 to 10.11.13, 11.4.0 to 11.4.3, 11.5.0 to 11.5.1
Timeline
- 2026-05-15: disclosed
- 2026-05-15: advisory