CVE-2026-6957: Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.
Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore via a malicious filename delivered through the shared-channel attachment sync protocol. Mattermost Advisory ID: MMSA-2026-00659
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6957?
The severity of CVE-2026-6957 is classified as high with a score of 8.
How do I fix CVE-2026-6957?
To fix CVE-2026-6957, update the Mattermost Legal Hold plugin to version 1.1.6 or higher.
What does CVE-2026-6957 exploit?
CVE-2026-6957 exploits a path traversal vulnerability caused by unsanitized file names from federated peers.
Who is affected by CVE-2026-6957?
Mattermost users utilizing versions of the Legal Hold plugin that are 1.1.5 or lower are affected by CVE-2026-6957.
What can attackers do with CVE-2026-6957?
Attackers can write files to arbitrary locations within the target server's filestore by exploiting CVE-2026-6957.