CVE-2026-13426 json
Client4 fails to validate path parameters
published 2026-06-26 4 mo ago modified 2026-11-06 3 d ago also GHSA-72v2-v53v-4qmm , GO-2026-6910 , EUVD-2026-39661
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532
Patch / fix
- go github.com/mattermost/mattermost/server/public 0.1.22
- Mattermost github.com/mattermost/mattermost/server/public v0.1.22
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/public | <0.1.22 |
0.1.22 |
Affected products
- Mattermost github.com/mattermost/mattermost/server/public
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/mattermost/mattermost/pull/34499
web
-
github.com
/mattermost/mattermost/pull/39305
web
-
github.com
/mattermost/mattermost/commit/2b075c9b74effbb56f3769f1bdec161eef4c6808
web, patch
-
github.com
/mattermost/mattermost/commit/64c16ff0ea7f455ee648bfe906407def1274fbd3
web, patch
-
mattermost.com
/security-updates
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-13426
advisory
-
github.com
/mattermost/mattermost
package
-
github.com
/mattermost/mattermost/releases/tag/server/public/v0.1.22
web
-
github.com
/advisories/GHSA-72v2-v53v-4qmm
advisory
Sources
- CVE List CVE-2026-13426
- GitHub Advisory GHSA-72v2-v53v-4qmm
- NVD CVE-2026-13426
- OSV GO-2026-6910
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.