CVE-2026-93851
CVE-2026-93851 · Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742
CVSS 8.0 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
mattermost
- Versiones
- ≥ 11.9.0, ≤ 11.9.1: Afectada (semver)
- ≥ 11.8.0, ≤ 11.8.5: Afectada (semver)
- ≥ 11.7.0, ≤ 11.7.10: Afectada (semver)
- 11.10.0: No afectada
- 11.9.2: No afectada
- 11.8.6: No afectada
- 11.7.11: No afectada
Actualiza a 11.7.11; Actualiza a 11.8.6; Actualiza a 11.9.2