https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T21:03:07.489784+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-6957 CVE-2026-6957 — Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file writ… 2026-10-19T21:03:07.491360+00:00

Affected: Mattermost

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore via a malicious filename delivered through the shared-channel attachment sync protocol. Mattermost Advisory ID: MMSA-2026-00659