---
id: CVE-2026-14298
title: >-
  Boards archive import endpoint allows resource exhaustion via zip bomb and
  file size limit bypass in Mattermost
summary: >-
  Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7,
  10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the
  configured maximum file size in the Boards archive import handler, which
  allows an auth…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-409
vendor: Mattermost
product: Mattermost
affected:
  - Mattermost >= 11.9.0 <= 11.9.0
  - Mattermost >= 11.8.0 <= 11.8.4
  - Mattermost >= 11.7.0 <= 11.7.7
  - Mattermost >= 10.11.0 <= 10.11.22
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-13T14:16:43.935232Z'
published: '2026-08-13'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T10:35:32.564Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-14298'
references:
  - url: 'https://mattermost.com/security-updates'
    label: MMSA-2026-00713
tags:
  - cve.org
epss: 0.0042
epssPercentile: 0.33698
ingestedAt: '2026-09-14T15:23:07.463Z'
---

## Overview

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

## Affected

- `Mattermost >= 11.9.0 <= 11.9.0`
- `Mattermost >= 11.8.0 <= 11.8.4`
- `Mattermost >= 11.7.0 <= 11.7.7`
- `Mattermost >= 10.11.0 <= 10.11.22`

## Remediation

Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher.