PT-2026-41641

CVE-2026-3495

Published

2026-05-18

Updated

2026-07-30

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description Failure to escape certain variables during the composition of error pages allows an attacker with permissions to edit site configurations to execute malicious code by injecting JavaScript into those values.

Recommendations Update versions 11.5.0 through 11.5.1 to a version later than 11.5.1. Update versions 10.11.0 through 10.11.13 to a version later than 10.11.13.

Exploitability

Exploit

Fix

Impacts

Researchers

Shoodagiri

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-3495