Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync (CVE-2026-6961)

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync (CVE-2026-6961) | HOL Guard CVE

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
github.com/mattermost/mattermost-servergo	=11.6.0	11.6.1
github.com/mattermost/mattermost-servergo	>=11.5.0,<=11.5.4	11.5.5
github.com/mattermost/mattermost-servergo	>=10.11.0,<=10.11.15	10.11.17
github.com/mattermost/mattermost/server/v8go	>=8.0.0-20250731163400-5b955468ea1e,<8.0.0-20260423180926-c021eeaff8f0	8.0.0-20260423180926-c021eeaff8f0

Recommended response

Check inventory. Check lockfiles and deployed manifests for github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server.
Review the reported fix. Update github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.5; github.com/mattermost/mattermost-server to 10.11.17; github.com/mattermost/mattermost/server/v8 to 8.0.0-20260423180926-c021eeaff8f0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 12, 2026
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Aug 24, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Aug 25, 2026

Sources and claim methodology

Upstream source description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field. Mattermost Advisory ID: MMSA-2026-00661

Quoted source text, attributed separately from HOL analysis.