CVE-2026-4858: Mattermost path traversal in integration action URL

CVE-2026-4858 · Severity: high · CVSS 8 · Published 2026-05-21

Mattermost, a collaboration and messaging platform, contains a security flaw in how it handles integration URLs. A malicious user with a standard account could exploit this to perform actions as a system administrator, potentially leading to full control over the platform and access to sensitive corporate communications. Organizations should update to the latest patched versions to prevent unauthorized administrative access.

Technologies: github.com/mattermost/mattermost-server (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-4858 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4858 being exploited in the wild.
How severe is CVE-2026-4858?
High severity, with a CVSS score of 8, published 21 May 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.15+incompatible,introduced=11.4.0+incompatible,fixed=11.4.5+incompatible,introduced=11.5.0+incompatible,fixed=11.5.4+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14, 11.6.0, 11.5.0-11.5.3, 11.4.0-11.4.4, 10.11.0-10.11.14.
Is there a fix for CVE-2026-4858?
Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4858 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-4858?
Check whether you run github.com/mattermost/mattermost-server (Go) or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.6.1+incompatible

Technical details

A path traversal vulnerability (CWE-22) exists in Mattermost Server's handling of integration action URLs. The application fails to properly validate or sanitize these URLs, allowing a malicious authenticated user to inject traversal sequences. By doing so, the attacker can redirect requests to internal API endpoints. Because these requests may be processed using a system administrator's authentication token, the attacker can achieve a privilege escalation to call arbitrary administrative APIs. The exploit requires low privileges but involves high complexity and some user interaction. Patches are available in versions 11.6.1, 11.5.4, 11.4.5, and 10.11.15.

Affected products

  • Mattermost Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14

Identifiers

  • CVE-2026-4858
  • GHSA-c4r7-j7pp-r8mp
  • GO-2026-5311

Timeline

  • 2026-05-21: disclosed
  • 2026-05-21: advisory
  • 2026-06-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.