Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability described is a path traversal issue in Mattermost's file upload functionality. By analyzing the provided patch, I identified the exact location of the fix. The commit d6b35c41f0ae5 directly addresses the vulnerability. The key change is in the server/channels/api4/upload.go file, within the createUpload function. The addition of us.Filename = filepath.Base(us.Filename) sanitizes the user-provided filename by stripping any directory information, thus mitigating the path traversal attack. The corresponding test file, server/channels/api4/upload_test.go, confirms this by adding a test case that attempts to use a malicious filename (../../../image.png) and asserts that it gets cleaned to image.png. Therefore, the createUpload function is the vulnerable function, as it was the entry point for processing the malicious file upload request.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | >= 10.8.0, <= 10.8.3 | 10.8.4 |
| github.com/mattermost/mattermost-server | go | >= 10.5.0, <= 10.5.8 | 10.5.9 |
| github.com/mattermost/mattermost-server | go | >= 10.9.0, <= 10.9.3 | 10.9.4 |
| github.com/mattermost/mattermost-server | go | = 10.10.0 | 10.10.1 |
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250708173752-d6b35c41f0ae5 | 8.0.0-20250708173752-d6b35c41f0ae5 |
