CVE-2026-93851
CVE-2026-93851 · Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742
CVSS 8.0 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
mattermost
- Versions
- ≥ 11.9.0, ≤ 11.9.1: Affected (semver)
- ≥ 11.8.0, ≤ 11.8.5: Affected (semver)
- ≥ 11.7.0, ≤ 11.7.10: Affected (semver)
- 11.10.0: Not affected
- 11.9.2: Not affected
- 11.8.6: Not affected
- 11.7.11: Not affected
Update to 11.7.11; Update to 11.8.6; Update to 11.9.2