Mattermost fails to sanitize the FileInfo.Name field received from federated peers during shared channel file sync. The flaw allows an attacker who controls a federated server to write files to arbitrary locations within the target server’s filestore via path traversal sequences in the filename. This can lead to overwriting critical configuration files or storing malicious binaries, thereby compromising the integrity of the system. The weakness is a classic path traversal flaw (CWE-22).

The vulnerability affects Mattermost, versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, 10.11.x up to 10.11.15, and 10.11.x up to 10.11.16. Any deployment of these versions that has federation enabled and accepts file sync from an external server is vulnerable.

The CVSS score of 7.6 indicates high severity. The EPSS score is not available, so the exploitation probability is currently unknown. The vulnerability is not listed in CISA’s KEV catalog. An attacker must control a federated peer and initiate a file sync; the likely attack vector is network‑based through the federation channel, allowing the attacker to write arbitrary files to the target server’s filestore.