CVE-2026-4858

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14

Description A path traversal issue exists where the application fails to properly validate the integration action URL. This allows an authenticated malicious user to perform path traversal to call an arbitrary API using the system administrator's authentication token. Path traversal is a technique used to access files or directories outside the intended folder by using special characters like ../ in a file path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.