CVE-2026-4858

CriticalCVSS 9.9/10Last modified Jul 23, 2026

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-485805.5Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-485817.8Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.CVE-2026-485829.6Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.CVE-2026-485837.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-485848.8Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.CVE-2026-485867.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. CVE-2026-485875.3An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip le CVE-2026-485885.3An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache res CVE-2026-485895.4Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, i CVE-2026-48596.4The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carouse CVE-2026-485902.1XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is assoc CVE-2026-485914.8Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unesc