CVE-2026-13426: Mattermost Path Traversal in API Route Handling (v0.1.22 Fix)

Technical summary

CVE-2026-13426 is a path traversal vulnerability (CWE-22) in the Mattermost Go module github.com/mattermost/mattermost/server/public. The vulnerable code fails to sanitize path parameters when constructing API route paths, allowing attackers to inject traversal sequences (such as ../ or similar path manipulation characters) into IDs. This causes API calls to be routed to unintended endpoints, bypassing authorization checks tied to specific routes. The vulnerability requires authenticated access and does not directly enable remote code execution, but allows lateral movement within the API surface and potential unauthorized information disclosure or modification.

Business impact

This vulnerability creates a privilege escalation and data exposure risk for Mattermost deployments. Authenticated users—including those with limited roles—can access or modify resources outside their intended scope by manipulating request IDs. In multi-team or multi-workspace environments, this could lead to cross-boundary data access. Organizations relying on Mattermost for internal communications should prioritize patching to prevent sensitive conversations, files, or channel data from being exposed to lower-privileged users.

Affected systems

The vulnerability affects mattermost/server/public versions earlier than v0.1.22. Organizations running Mattermost server instances should determine their current module version and compare it against v0.1.22. The vulnerability requires the attacker to be an authenticated user of the Mattermost instance, so only deployments exposed to internal or external users are at operational risk.

Exploitability

Exploitability is moderate. The attack requires valid authentication credentials and low complexity—an attacker only needs to craft a malicious ID string and include it in an API request. No special privileges or user interaction is required once authenticated. However, successful exploitation depends on the attacker's knowledge of the API route structure and target resource IDs, which may limit opportunistic attacks. The network-accessible nature of Mattermost APIs means any authenticated user can attempt exploitation.

Remediation

Upgrade mattermost/server/public to version v0.1.22 or later. Verify the upgrade via the mattermost/mattermost GitHub repository and Mattermost Advisory MMSA-2025-00532 for patched release information. Organizations should test the upgrade in a staging environment before production deployment to ensure no breaking changes or integrations are affected.

Patch guidance

Consult the official Mattermost advisory MMSA-2025-00532 and the mattermost/mattermost repository for release notes and upgrade instructions specific to your deployment model (self-hosted or cloud). Patching should be applied as soon as practical, as the vulnerability is accessible to any authenticated user. Consider scheduling maintenance during a low-traffic window to minimize operational disruption.

Detection guidance

Monitor API access logs for unusual patterns: requests containing path traversal sequences (../, ..\, %2e%2e%2f) in ID parameters, requests targeting routes inconsistent with the authenticated user's role or team assignment, and unexpected errors or redirects from API endpoints. Implement WAF or API gateway rules to block requests with encoded or unencoded traversal sequences in URL paths and parameters. Correlate authentication logs with API calls to identify suspicious cross-boundary access attempts.

Why prioritize this

Although unranked on CISA's KEV list, this vulnerability merits prompt attention due to its low attack complexity, requirement for only standard authentication, and potential for lateral data movement in shared communication platforms. The CVSS score of 5.4 (MEDIUM) reflects limited direct impact—no availability loss or remote code execution—but the confidentiality and integrity risks are significant in collaborative environments where data segregation is a control boundary.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects: network accessibility (AV:N), low attack complexity (AC:L), requirement for valid user authentication (PR:L), no user interaction needed (UI:N), single system impact scope (S:U), and low confidentiality and integrity impact (C:L, I:L) with no availability impact (A:N). The score does not account for organizational context—teams heavily dependent on data isolation between users or strict role-based access control may find the practical risk higher than CVSS indicates.

Frequently asked questions