MEDIUM 5.4 Go
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
GHSA-72v2-v53v-4qmm · CVE-2026-13426
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-13426
- WEB https://github.com/mattermost/mattermost/pull/34499
- WEB https://github.com/mattermost/mattermost/pull/39305
- WEB https://github.com/mattermost/mattermost/commit/2b075c9b74effbb56f3769f1bdec161eef4c6808
- WEB https://github.com/mattermost/mattermost/commit/64c16ff0ea7f455ee648bfe906407def1274fbd3
- PACKAGE https://github.com/mattermost/mattermost
- WEB https://github.com/mattermost/mattermost/releases/tag/server/public/v0.1.22
- WEB https://mattermost.com/security-updates
Ready to move
Start Securing
Free, no credit card | First findings in minutes