The vulnerability lies in the Mattermost Go module github.com/mattermost/mattermost/server/public, where insufficient validation of path parameters used when building API route paths allows an attacker to craft identifiers containing path‑traversal components and redirect API calls to unintended endpoints. This could enable the attacker to access, invoke, or manipulate data at unauthorized routes, potentially bypassing intended access controls. The flaw is categorized as CWE‑22, Path Traversal.

Versions of the Mattermost Go module github.com/mattermost/mattermost/server/public earlier than v0.1.22 are impacted. This includes deployments of the Mattermost server that still use a pre‑0.1.22 module version.

The severity is moderate with a CVSS score of 5.4 and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can send crafted API requests to the affected server can exploit the flaw by embedding path traversal strings such as "/../" in the identifier portion of the URL, causing the request routing layer to resolve to a different, unintended endpoint. Because the flaw requires no special privileges beyond the ability to issue API calls, the attack vector is likely remote and the exploitation conditions are simple, but the impact is limited to unintended API access rather than arbitrary code execution.