Mattermost versions 11.8.x through 10.11.x contain a path‑traversal vulnerability in the remove file API that allows an administrator with SAML system‑console write permissions to specify a file path outside the configuration directory and delete that file. This flaw permits arbitrary file removal on the host, which can lead to data loss, configuration corruption, or enable further compromise if the deleted files contain credentials or executables. The weakness is classified as CWE‑22 paths and is not a direct code‑execution flaw but can undermine system integrity.

The flaw affects Mattermost Enterprise and community editions in the following versions: 11.8.x up to 11.8.0, 11.7.x up to 11.7.3, 11.6.x up to 11.6.5, and 10.11.x up to 10.11.20. The vulnerability exists only for installations that expose the remove file endpoint to users with SAML system‑console write rights.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1%, meaning exploitation is currently considered low probability. The vulnerability is not listed in the CISA KEV catalog. Execution requires administrative privileges and the ability to access the SAML system‑console write interface; therefore, the risk is confined to environments where such privileges are distributed. In the event of privilege misuse or compromise, the attacker could delete critical files, potentially leading to service disruption or enabling further attacks.