CVE-2026-6957 — Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file wri…

CVE-2026-6957

Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write. PUBLISHED

Description (CNA)

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore via a malicious filename delivered through the shared-channel attachment sync protocol. Mattermost Advisory ID: MMSA-2026-00659

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 1.1.5; unaffected .0

CWE

CWE-22

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.