CVE-2026-13426: Mattermost Github.com/mattermost/mattermost/server/public

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532

Affected products

• Mattermost Github.com/mattermost/mattermost/server/public: from v0.0.0, before v0.1.22 (fixed in v0.1.22)

Published 2026-06-26. Last modified 2026-06-26.