Executive brief
Mattermost Plugins are used to extend the functionality of the Mattermost collaboration platform, including features for synchronizing data between different organizations. A security flaw allows an administrator of a connected (federated) external server to bypass security restrictions and write files to unauthorized locations on the target server's storage. This could lead to data corruption, unauthorized file placement, or potential system compromise if critical files are overwritten.
Technical details
A path traversal vulnerability (CWE-22) exists in Mattermost Plugins versions <=1.1.5 due to insufficient sanitization of filenames received from federated peers. The vulnerability is triggered during the shared-channel attachment sync protocol when the plugin uses unsanitized filenames to construct export destination paths. An attacker with administrative privileges on a remote federated Mattermost server can provide a malicious filename containing traversal sequences (e.g., ../) to write files to arbitrary locations within the target server's filestore. While the attack requires high privileges (PR:H) and specific configuration (federation), the impact is significant as it crosses security boundaries (S:C).
Affected products
- Mattermost Mattermost Plugins <=1.1.5
Timeline
- 2026-05-27: disclosed: CVE-2026-6957 published by NVD and Mattermost