PT-2026-52708

CVE-2026-13426

Published

2026-06-26

Updated

2026-11-05

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions github.com/mattermost/mattermost/server/public versions prior to 0.1.22

Description The software fails to validate path parameters when constructing API route paths. This allows an attacker to redirect API calls to unintended endpoints by using crafted IDs that include path traversal components, which are sequences of characters used to access files or directories outside the intended folder.

Recommendations Update github.com/mattermost/mattermost/server/public to version 0.1.22 or later.

Exploitability

Fix

Impacts

Researchers

Juho Forsén

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-13426