Github.com/mattermost/mattermost-server/v5

This hub aggregates every CVE we track for Github.com/mattermost/mattermost-server/v5, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Github.com/mattermost/mattermost-server/v5.

• CVE-2025-11776Guest user can discover archived public channels4.3Nov 14, 2025
• CVE-2025-11777Cross-team channel membership access3.1Nov 13, 2025
• CVE-2025-8402Nil pointer dereference in bulk import crashes server4.9Aug 21, 2025
• CVE-2025-47870Team invite ID leaked to team admin with no member invite privileges4.3Aug 21, 2025
• CVE-2025-49222Mattermost Shared Channel Upload Type Validation Bypass6.8Aug 21, 2025
• CVE-2025-8023Path Traversal in Template Upload Allows Uploading Files Outside Target Directory6.8Aug 21, 2025
• CVE-2025-53971Channel and Team Membership APIs inadvertently allow loss of Member privileges.3.8Aug 21, 2025
• CVE-2025-36530Import Path Traversal Enables Unauthorized Unsigned Plugin Installation6.8Aug 21, 2025
• CVE-2024-39837Malicious remote can create arbitrary channels3.8Aug 1, 2024
• CVE-2024-28053Resource Exhaustion via the Invitation Feature3.1Mar 15, 2024
• CVE-2023-5968Password hash in response body after username update4.9Nov 6, 2023
• CVE-2023-1776Stored XSS via SVG attachment on Boards7.3Mar 31, 2023
• CVE-2023-1775Unsanitized events sent over Websocket to regular users in a High Availability environment4.3Mar 31, 2023
• CVE-2023-1774Unauthorized email invite to a private channel4.2Mar 31, 2023
• CVE-2022-1332Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents4.3Apr 13, 2022