Authenticated attackers can upload a specially crafted 7zip archive that contains an excessive number of folder declarations. The Mattermost server fails to validate the archive structure before extracting it, which causes the process to allocate large amounts of memory and ultimately exhaust the system’s resources. This leads to a denial‑of‑service condition that can render the Mattermost service unable to respond to legitimate users.

The vulnerability affects Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3. The affected product is the Mattermost server application; the problem surfaces when authenticated users upload 7zip files to the server.

The CVSS score of 4.3 indicates a medium severity, but only attackers with authentication are able to trigger the issue. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires an authenticated user, an attacker would need access to legitimate credentials to exploit it, but once able, they can induce a DoS that may impact availability for all users. The lack of a publicly known exploit and the moderate CVSS mitigate the immediate threat, though the DoS potential remains significant for affected deployments.