# CVE-2026-6957: Mattermost Plugins path traversal in shared-channel attachment sync

Source: https://junglewise.ai/threats/cve-2026-6957-mattermost-plugins-path-traversal-in-shared-channel-attachment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-6957 · Severity: high · CVSS 8 · Published 2026-05-27

Mattermost Plugins are used to extend the functionality of the Mattermost collaboration platform, including features for synchronizing data between different organizations. A security flaw allows an administrator of a connected (federated) external server to bypass security restrictions and write files to unauthorized locations on the target server's storage. This could lead to data corruption, unauthorized file placement, or potential system compromise if critical files are overwritten.

Technologies: [Mattermost Plugins](https://junglewise.ai/threats/technologies/mattermost-plugins). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-6957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6957 being exploited in the wild.

**How severe is CVE-2026-6957?** High severity, with a CVSS score of 8, published 27 May 2026.

**Which products and versions are affected?** Mattermost Plugins <=1.1.5.

**Is there a fix for CVE-2026-6957?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6957 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6957?** Check whether you run Mattermost Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Mattermost Plugins versions <=1.1.5 due to insufficient sanitization of filenames received from federated peers. The vulnerability is triggered during the shared-channel attachment sync protocol when the plugin uses unsanitized filenames to construct export destination paths. An attacker with administrative privileges on a remote federated Mattermost server can provide a malicious filename containing traversal sequences (e.g., ../) to write files to arbitrary locations within the target server's filestore. While the attack requires high privileges (PR:H) and specific configuration (federation), the impact is significant as it crosses security boundaries (S:C).

## Affected products

- Mattermost Mattermost Plugins <=1.1.5

## Timeline

- 2026-05-27: disclosed: CVE-2026-6957 published by NVD and Mattermost

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost Plugins sensitive information disclosure in OpenAI logging](https://junglewise.ai/threats/cve-2026-9699-mattermost-plugins-sensitive-information-disclosure-in-openai)
- [Mattermost Plugins incorrect authorization in group subscriptions](https://junglewise.ai/threats/cve-2026-6342-mattermost-plugins-incorrect-authorization-in-group-subscriptions)
- [Mattermost Plugins incorrect authorization in group API requests](https://junglewise.ai/threats/cve-2026-6341-mattermost-plugins-incorrect-authorization-in-group-api-requests)
- [Mattermost Plugins timestamp validation failure in Zoom webhook](https://junglewise.ai/threats/cve-2026-3109-mattermost-plugins-timestamp-validation-failure-in-zoom-webhook)