CVE-2026-6957: Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.

Synopsis

A path traversal vulnerability in the Mattermost Legal Hold plugin (versions 1.1.5 and earlier) allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore. The attack is delivered over the network through the shared-channel attachment sync protocol and requires no interaction from a victim on the target server, though the attacker must control a remote federated server with admin credentials. Successful exploitation gives the attacker the ability to overwrite or plant arbitrary files anywhere the filestore is writable, with full confidentiality, integrity, and availability impact in the affected scope. A patched-image rebuild is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target Mattermost server over the network via the shared-channel attachment sync protocol exposed to federated peers.

• AuthenticationRequired

  The attacker must hold administrator credentials on a remote federated Mattermost server; a standard low-privilege account is not sufficient.

• Victim interactionNot required

  No action by any user on the target server is needed; the malicious filename is delivered passively through the sync protocol.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker depends on specific environmental conditions such as a live federation trust relationship being established between the attacker-controlled server and the target.

Blast Radius

• The attacker writes arbitrary files to any path within the target server's filestore that the application process can reach, enabling overwrite of existing Legal Hold export archives or other stored files.
• By planting files at chosen paths, the attacker can replace legitimate plugin assets or configuration files, corrupting the integrity of the server's stored data.
• If the filestore is shared with other services or the attacker overwrites executable or configuration content, the availability of those dependent services is disrupted.
• The attacker may read the contents of any file they can overwrite by replacing it with a known payload and retrieving it through the federation sync channel, exposing stored data including potentially sensitive Legal Hold records.