CVE-2023-6458

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-22

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	<= 9.1.1; <= 9.0.2; <= 8.1.4; <= 7.8.13

References

https://mattermost.com/security-updatesVendor Advisory
https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Dec 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-64595.3Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public CVE-2023-64605.5A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._sett CVE-2023-64616.1Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.CVE-2023-64626.1A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unk CVE-2023-64635.4A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vuln CVE-2023-64649.8A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is som CVE-2023-64656.1A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as problematic. This affects an un CVE-2023-64666.1A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file CVE-2023-64673.7A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file CVE-2023-64724.8A vulnerability, which was classified as problematic, has been found in PHPEMS 7.0. This issue affects some unknown processing of the file a CVE-2023-64735.4A vulnerability, which was classified as problematic, was found in SourceCodester Online Quiz System 1.0. This affects an unknown part of th CVE-2023-64746.5A vulnerability has been found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as problematic. This vulnerability aff