Mattermost Path Traversal Allows API Calls with Admin Token

The National Vulnerability Database has disclosed CVE-2026-4858, a high-severity path traversal vulnerability in Mattermost versions 11.6.0, 11.5.3, 11.4.4, and 10.11.14 and earlier. The flaw stems from Mattermost’s failure to adequately validate integration URLs, allowing an authenticated, malicious user to leverage path traversal in an integration action URL.

This vulnerability permits the attacker to call arbitrary APIs using a system administrator’s Mattermost authentication token. Essentially, a low-privileged user could escalate their access significantly, effectively gaining control over sensitive administrative functions within the Mattermost instance. The CVSS score of 8.0 (High) reflects the significant impact on confidentiality, integrity, and availability if exploited.

For defenders, this means a critical review of Mattermost instances is in order. Attackers will always look for these types of logical flaws that turn a minor privilege into a major compromise. The ability to invoke arbitrary APIs with an admin token is a direct path to full system control, data exfiltration, or further lateral movement.