Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93851— Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

Quick assessment

Affected
Mattermost Mattermost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mattermost 11.9.x（≤ 11.9.1）、11.8.x（≤ 11.8.5）和 11.7.x（≤ 11.7.10）版本在 Agents 插件的提及提醒（mention reminder）组件中未能正确验证目标帖子 ID。该漏洞允许具备在系统管理员可见频道中发帖权限的已认证用户，通过构造包含伪造提及提醒的帖子，诱使系统管理员点击，从而触发管理员浏览器发送非预期的 API 请求。该请求可导致已安装插件被替换，并在服务器上执行恶意代码。 Mattermost 安全公告编号：MMSA-2026-00742

CVSS 8.0 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93851

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Mattermost Mattermost 11.9.0 ~ 11.9.1 -

II. Public POCs for CVE-2026-93851

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93851

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Mattermost
Same vendor: Mattermost
Same weakness: CWE-22