Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-13426

Client4 fails to validate path parameters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost github.com/mattermost/mattermost/server/public

Default version status: unaffected

  • v0.0.0 to < v0.1.22affected
  • v0.1.22unaffected

References