CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field.. Mattermost Advisory ID: MMSA-2026-00661
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.16 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MMSA-2026-00661
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6961?
The severity of CVE-2026-6961 is rated as high, with a score of 7.6.
How do I fix CVE-2026-6961?
You can fix CVE-2026-6961 by updating Mattermost to versions 11.7.0, 11.6.2, 11.5.5, 10.11.16, 10.11.17 or higher.
What vulnerability does CVE-2026-6961 describe?
CVE-2026-6961 describes a path traversal vulnerability due to unsanitized FileInfo.Name in Mattermost federation sync.
What versions of Mattermost are affected by CVE-2026-6961?
Mattermost versions 11.6.x ≤ 11.6.1, 11.5.x ≤ 11.5.4, and 10.11.x ≤ 10.11.15 are affected by CVE-2026-6961.
Who can exploit the CVE-2026-6961 vulnerability?
An attacker who controls a federated server can exploit CVE-2026-6961 to write files to arbitrary locations.