CVE-2019-20851

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-208527.5An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresCVE-2019-208539.8An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execCVE-2019-208547.5An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side applicationCVE-2019-208557.5An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (CVE-2019-208569.8An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.CVE-2019-208577.5An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via maCVE-2019-208587.5An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted cCVE-2019-208597.5An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.CVE-2019-20868.8In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additionCVE-2019-208605.5An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of serviCVE-2019-208618.8An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.CVE-2019-208627.5An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.
CVE-2019-20851: Critical severity, CVSS 9.1 | Vulnix