4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6340

CVE-2026-6340: Mattermost doesn't validate 7zip archive structure before processing

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6340

CVE-2026-6340:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260325191733-fb11968f8798	8.0.0-20260325191733-fb11968f8798
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260325191733-fb11968f8798	5.3.2-0.20260325191733-fb11968f8798

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of 7zip archives, which could cause server memory exhaustion. The provided commit fb11968f8798 directly addresses this issue. The patch modifies the Extract function within the archiveExtractor struct in server/platform/services/docextractor/archive.go. The change involves adding a check to detect if a file is a 7zip archive by its name or content stream. If it is identified as a 7zip file, the function now immediately returns, effectively skipping the extraction process that was causing the vulnerability. This indicates that the docextractor.archiveExtractor.Extract function was the entry point for the vulnerable operation. An attacker would trigger this by uploading a malicious 7zip file, which would then be processed by this function.

Vulnerable functions

docextractor.archiveExtractor.Extract

server/platform/services/docextractor/archive.go

The `Extract` function in `archiveExtractor` is responsible for processing uploaded archive files. Prior to the patch, this function would attempt to extract 7zip archives. A vulnerability in the underlying 7zip extraction library (`bodgit/sevenzip`) could be triggered by a specially crafted archive, leading to excessive memory allocation and a denial-of-service. The function is vulnerable because it processes potentially malicious input (the archive file) without sufficient validation of the archive's structure, passing it to the vulnerable library.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.