VULNERABILITY INTELLIGENCE

CVE-2026-14298

CVSS score6.5 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-08-13
Last modified2026-09-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-409

Primary references