Mattermost versions 10.11.0 through 10.11.14, 11.4.0 through 11.4.4, 11.5.0 through 11.5.3, and 11.6.0 are vulnerable to a path traversal flaw in integration action URLs. An authenticated malicious user can use the traversal to reach an arbitrary API endpoint while carrying the system administrator’s authentication token. This allows the attacker to execute any API operation that the admin token permits, potentially modifying data, leaking information, or altering system configuration, thereby achieving remote code or privilege escalation.

Versions 10.11.0‑10.11.14, 11.4.0‑11.4.4, 11.5.0‑11.5.3, and 11.6.0 of the Mattermost product are affected. No other vendors or products are listed.

The CVSS score of 8.0 reflects a high severity impact, and while EPSS data is not available, the vulnerability’s nature and the need for authenticated access suggest a realistic exploitation risk within organizations that provide user accounts with the ability to create integrations. The flaw is not listed in CISA’s KEV catalog. The likely attack path involves a legitimate user configuring an integration and supplying a malicious URL containing traversal characters to force the backend to contact a targeted API under the administrative token context.