CVE-2026-93851

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

State: Published
Severity: 8.0 High
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 18, 2026

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H	Mattermost

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
MattermostMattermost	11.9.0 through 11.9.1Affected 11.8.0 through 11.8.5Affected 11.7.0 through 11.7.10Affected 11.10.0Not affected 11.9.2Not affected 11.8.6Not affected 11.7.11Not affected

References

MMSA-2026-00742vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.