CVE-2026-13426 — Client4 fails to validate path parameters

CVE-2026-13426

Client4 fails to validate path parameters PUBLISHED

Description (CNA)

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532

Affected (CNA)

Vendor / product	Versions
Mattermost / github.com/mattermost/mattermost/server/public	affected v0.0.0 before v0.1.22; unaffected v0.1.22

CWE

CWE-22

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.