Mattermost Path Traversal Vulnerability in Bulk Import File Attachments

A path traversal vulnerability has been identified in Mattermost versions 10.8.x prior to 10.8.1, 10.7.x prior to 10.7.3, 10.5.x prior to 10.5.7, and 9.11.x prior to 9.11.16. This vulnerability arises because the application fails to properly sanitize input paths for file attachments in bulk import JSONL files. As a result, a system administrator could exploit this flaw to read arbitrary system files via path traversal.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system files, potentially allowing for further exploitation or information disclosure.

Remediation

Users can upgrade to Mattermost versions 10.9.0, 10.8.2, 10.7.4, 10.6.6, or 9.11.17 to address this vulnerability.