Description
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | github.com/mattermost/mattermost/server/public | v0.0.0 – < v0.1.22 | v0.1.22 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/public | < 0.1.22 | 0.1.22 | GHSA-72v2-v53v-4qmm |
Advisories 1
- WID-SEC-2026-2107 Mattermost Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 27, 2026
References
- MMSA-2025-00532 vendor-advisory