Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Mattermost Server allows unauthorized file access

CVE-2017-18874 · published 6 years ago
Summary

An attacker with admin privileges can access files outside of their intended location on the server. This means they may be able to read or modify sensitive files, potentially compromising the security of your Mattermost installation. You should update to the latest version or disable local storage for files to mitigate this risk.

What to do
  • Update github.com mattermost to version 4.1.2-0.20171004201910-6be8113eb60.
  • Update github.com mattermost to version 4.2.1-0.20171004194140-6d3cb2ce07fc.
  • Update github.com mattermost to version 4.3.0.
Affected software
Ecosystem VendorProductAffected versions
go github.com mattermost < 4.1.2-0.20171004201910-6be8113eb60
>= 4.2.0-rc1, < 4.2.1-0.20171004194140-6d3cb2ce07fc
>= 4.3.0-rc1, < 4.3.0
Fix: upgrade to 4.1.2-0.20171004201910-6be8113eb60
– mattermost mattermost_server < 4.1.2
>= 4.2.0, < 4.2.1
4.3.0
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
References
Severity
6.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published19 Jun 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-8qg8-c7mw-6fj7 · GHSA
CVE-2017-18874 · NVD
Track software like this
Free during beta