Vulnérabilité de Traversal de Chemin (Path Traversal) dans Mattermost github.com/mattermost/mattermost-server

The core of this vulnerability lies in the improper handling of user-supplied input, allowing an attacker to manipulate file paths and access files outside of the intended directory. A successful exploit could enable an attacker to read configuration files, source code, or even sensitive user data stored on the server. The blast radius extends to any data accessible by the Mattermost Server process, and the potential for lateral movement depends on the server's overall security posture and access controls. While no direct precedent is immediately obvious, path traversal vulnerabilities often lead to information disclosure and privilege escalation.

Organizations utilizing Mattermost Server for internal communication, particularly those running older, unpatched versions, are at risk. Shared hosting environments where Mattermost is installed alongside other applications are also vulnerable, as a compromise of Mattermost could potentially impact other hosted services. Teams relying on Mattermost for sensitive data storage should prioritize patching.

• linux / server:

journalctl -u mattermost -g 'path traversal'

• generic web:

curl -I 'http://mattermost.example.com/../../../../etc/passwd' # Check for 200 OK response

1. 2025-09-24Disclosure

   disclosure

1. Réservé2025-08-15
2. Publiée2025-09-24
3. Modifiée2026-03-03
4. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade Mattermost Server to version 9.11.18+incompatible or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to filter out malicious path traversal attempts. Specifically, look for patterns involving .. sequences in file paths. Review and restrict file permissions on the Mattermost Server installation directory to limit the potential damage from a successful exploit. Monitor Mattermost server logs for unusual file access attempts. After upgrade, confirm by attempting to access a known restricted file via a web request and verifying that access is denied.