CVE-2026-13426

Name of the Vulnerable Software and Affected Versions github.com/mattermost/mattermost/server/public versions prior to 0.1.22

Description The software fails to validate path parameters when constructing API route paths. This allows an attacker to redirect API calls to unintended endpoints by using crafted IDs that include path traversal components, which are sequences of characters used to access files or directories outside the intended folder.

Recommendations Update github.com/mattermost/mattermost/server/public to version 0.1.22 or later.