# CVE-2026-6961: Mattermost path traversal in shared channel file sync Source: https://junglewise.ai/threats/cve-2026-6961-mattermost-path-traversal-in-shared-channel-file-sync Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-12. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-6961 · Severity: high · CVSS 7.6 · Published 2026-06-12 Mattermost is a team collaboration platform that allows organizations to securely share files and communicate. When Mattermost servers are federated (connected to other Mattermost instances), they synchronize shared channel files without properly validating filenames from peer servers. An attacker who controls a federated Mattermost server can craft malicious filenames containing path traversal sequences (e.g., "../../") to write files to arbitrary locations on the target server's disk, potentially compromising data integrity or enabling further attacks. Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5), [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6), [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost). ## Quick answers **Is CVE-2026-6961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6961 being exploited in the wild. **How severe is CVE-2026-6961?** High severity, with a CVSS score of 7.6, published 12 June 2026. **Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260423180926-c021eeaff8f0; and 1 more. **Is there a fix for CVE-2026-6961?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260423180926-c021eeaff8f0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-6961 attacked?** It is attacked over the network, in a hosted service. **Am I affected by CVE-2026-6961?** Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later ```sh go get github.com/mattermost/mattermost-server@v11.6.1+incompatible ``` - github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260423180926-c021eeaff8f0 or later ```sh go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260423180926-c021eeaff8f0 ``` ## Technical details The vulnerability is a path traversal (CWE-22) in the shared channel file synchronization mechanism. When federated peers send FileInfo objects during shared channel file sync, the receiving server fails to sanitize the FileInfo.Name field before using it to construct file paths. An attacker who has control over a federated Mattermost server can inject path traversal sequences (e.g., "../" or "..\") into the filename field, causing files to be written outside the intended filestore directory. The attack requires high privileges (federation server admin or equivalent) but operates over the network. The impact is limited to file integrity (no confidentiality impact reported). Patches sanitize filenames using filepath.Base, Unicode normalization (NFC), ASCII control character stripping, and path length validation, available in versions 11.6.2, 11.5.5, 10.11.17 and later. ## Affected products - Mattermost Mattermost Server 11.6.0-11.6.1, 11.5.0-11.5.4, 10.11.0-10.11.15 ## Identifiers - CVE-2026-6961 - GHSA-8qq9-cqj8-82w4 - GO-2026-6281 ## Timeline - 2026-06-12: disclosed: Vulnerability published in GitHub Advisory Database - 2026-04-23: patched: Fix merged upstream (PR #36223) - 2026-04-24: patched: Patch backported to release branches (11.7, 11.6, 11.5, 10.11) ## References - [https://mattermost.com/security-updates](https://mattermost.com/security-updates) - [https://github.com/mattermost/mattermost/pull/36223](https://github.com/mattermost/mattermost/pull/36223) - [https://github.com/mattermost/mattermost/pull/36251](https://github.com/mattermost/mattermost/pull/36251) - [https://github.com/mattermost/mattermost/pull/36252](https://github.com/mattermost/mattermost/pull/36252) - [https://github.com/mattermost/mattermost/pull/36253](https://github.com/mattermost/mattermost/pull/36253) ## Related threats - [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10) - [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1) - [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)