CVE-2026-6961: CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

Synopsis

A path traversal vulnerability in Mattermost's shared channel federation sync allows an attacker who controls a federated server to write files to arbitrary locations in the target server's filestore. The flaw is reachable over the network and requires a high-privilege (admin-level) federation peer relationship, with no victim interaction needed. Successful exploitation lets an attacker overwrite or plant files anywhere the Mattermost filestore process can write, with high integrity impact and limited availability disruption. Patched-image rebuilds at versions 10.11.16, 10.11.17, 11.5.5, 11.6.2, and 11.7.0 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target Mattermost server over the network, as the federation sync endpoint is exposed as a network service.

• AuthenticationRequired

  The attacker must control a server that holds a high-privilege federated peer relationship with the target; any lower-privilege account is insufficient.

• Victim interactionNot required

  No user action on the target server is needed; the malicious filename is submitted directly by the attacker-controlled federated peer.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a federated peer relationship exists; no race conditions or special memory layout are required.

Blast Radius

• Attacker writes arbitrary files to any path the Mattermost filestore process can reach, including overwriting existing configuration or plugin files.
• Placing attacker-controlled files in executable or configuration paths can set up further compromise of the Mattermost server process.
• Overwriting or corrupting filestore content disrupts file availability for users, consistent with the low availability impact in the CVSS score.
• No direct confidentiality exposure is indicated; the primary risk is unauthorized modification of stored data and server files.