GO-2026-6910: Path traversal in API route construction in github.com/mattermost/mattermost/server/public

Q: Do the supplied details identify affected or fixed versions?

No affected or fixed version numbers are provided in the supplied data. Version-specific exposure cannot be determined from this record alone.

Q: Where can responders review the available remediation changes?

The supplied references include two Mattermost commits: 2b075c9b74effbb56f3769f1bdec161eef4c6808 and 64c16ff0ea7f455ee648bfe906407def1274fbd3. A GitHub Security Advisory reference, GHSA-72v2-v53v-4qmm, is also provided.

Published Nov 5, 2026

Updated

Path traversal in API route construction in github.com/mattermost/mattermost/server/public

Affected Software

1 affected componentFixes available

go/github.com/mattermost/mattermost/server/public<0.1.22

0.1.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/mattermost/mattermost/server/public to a version that resolves this vulnerability.
Fixed in 0.1.22

Event History

Nov 5, 2026

Advisory Published

via OSV·11:49 PM

Data Sourced

via OSV·11:49 PM

DescriptionAffected Software

Frequently Asked Questions

Do the supplied details identify affected or fixed versions?

No affected or fixed version numbers are provided in the supplied data. Version-specific exposure cannot be determined from this record alone.

Where can responders review the available remediation changes?

The supplied references include two Mattermost commits: 2b075c9b74effbb56f3769f1bdec161eef4c6808 and 64c16ff0ea7f455ee648bfe906407def1274fbd3. A GitHub Security Advisory reference, GHSA-72v2-v53v-4qmm, is also provided.

GO-2026-6910: Path traversal in API route construction in github.com/mattermost/mattermost/server/public

Affected Software

Remediation

Event History

Frequently Asked Questions

Do the supplied details identify affected or fixed versions?

Where can responders review the available remediation changes?

Company

Resources

Contact

Frequently Asked Questions

Do the supplied details identify affected or fixed versions?

Where can responders review the available remediation changes?