CVE-2026-6961

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.6.0 through 11.6.1 Mattermost versions 11.5.0 through 11.5.4 Mattermost versions 10.11.0 through 10.11.16

Description Insufficient sanitization of the FileInfo.Name variable received from federated peers during shared channel file synchronization allows an attacker controlling a federated server to perform a path traversal attack. This enables the attacker to write files to arbitrary locations within the target server's filestore by using path traversal sequences in the filename field.

Recommendations Update versions 11.6.0 through 11.6.1 to a newer version. Update versions 11.5.0 through 11.5.4 to a newer version. Update versions 10.11.0 through 10.11.16 to a newer version.