---
id: CVE-2026-6961
aliases:
  - GHSA-8qq9-cqj8-82w4
title: >-
  Mattermost doesn't sanitize FileInfo.Name received from federated peers during
  shared channel file sync
summary: >-
  Mattermost doesn't sanitize FileInfo.Name received from federated peers during
  shared channel file sync
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L'
vendor: mattermost
product: github.com/mattermost/mattermost-server
ecosystem: go
affected:
  - 'github.com/mattermost/mattermost-server >= 11.6.0, < 11.6.1'
  - 'github.com/mattermost/mattermost-server >= 11.5.0, < 11.5.5'
  - 'github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.17'
  - >-
    github.com/mattermost/mattermost/server/v8 >=
    8.0.0-20250731163400-5b955468ea1e, < 8.0.0-20260423180926-c021eeaff8f0
patched:
  - github.com/mattermost/mattermost-server 11.6.1
  - github.com/mattermost/mattermost-server 11.5.5
  - github.com/mattermost/mattermost-server 10.11.17
  - github.com/mattermost/mattermost/server/v8 8.0.0-20260423180926-c021eeaff8f0
published: '2026-06-12'
updated: '2026-08-25'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8qq9-cqj8-82w4'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6961'
  - url: 'https://github.com/mattermost/mattermost/pull/36255'
  - url: 'https://github.com/mattermost/mattermost/pull/36253'
  - url: 'https://github.com/mattermost/mattermost/pull/36252'
  - url: 'https://github.com/mattermost/mattermost/pull/36251'
  - url: 'https://github.com/mattermost/mattermost/pull/36223'
  - url: >-
      https://github.com/mattermost/mattermost/commit/c896a63dc44c2f9c081a0a15bfddc4e6eb50e753
  - url: >-
      https://github.com/mattermost/mattermost/commit/c021eeaff8f003034ab40f82c552cc26a710a8fd
  - url: >-
      https://github.com/mattermost/mattermost/commit/a9f3868e1eee9ec61855cd7277f39937385efffd
  - url: >-
      https://github.com/mattermost/mattermost/commit/a0056ed68d95f64d7c4586985e7b7f16b96b3bec
  - url: >-
      https://github.com/mattermost/mattermost/commit/61d68d2d6ee81a5919597d91c736c502d7156859
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v10.11.16'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v11.5.5'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v11.6.2'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v11.7.0'
  - url: 'https://mattermost.com/security-updates'
  - url: 'https://github.com/mattermost/mattermost'
tags:
  - osv
  - go
epss: 0.00305
epssPercentile: 0.23498
ingestedAt: '2026-08-25T19:26:22.992Z'
---

## Overview

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field. Mattermost Advisory ID: MMSA-2026-00661

## Affected packages

- `github.com/mattermost/mattermost-server >= 11.6.0, < 11.6.1`
- `github.com/mattermost/mattermost-server >= 11.5.0, < 11.5.5`
- `github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.17`
- `github.com/mattermost/mattermost/server/v8 >= 8.0.0-20250731163400-5b955468ea1e, < 8.0.0-20260423180926-c021eeaff8f0`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost-server 11.6.1`
- `github.com/mattermost/mattermost-server 11.5.5`
- `github.com/mattermost/mattermost-server 10.11.17`
- `github.com/mattermost/mattermost/server/v8 8.0.0-20260423180926-c021eeaff8f0`