{"schema":"threatline.record/2","record":{"id":"CVE-2026-93851","aliases":[],"summary":"Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post","details":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742","categories":["Applications & CMS"],"product":"Mattermost","vendor":"Mattermost","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93851","source_modified_at":"2026-10-28T21:41:15.727Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"Mattermost","vendor":"Mattermost","versions":[{"lessThanOrEqual":"11.9.1","status":"affected","version":"11.9.0","versionType":"semver"},{"lessThanOrEqual":"11.8.5","status":"affected","version":"11.8.0","versionType":"semver"},{"lessThanOrEqual":"11.7.10","status":"affected","version":"11.7.0","versionType":"semver"},{"version":"11.10.0","status":"unaffected"},{"version":"11.9.2","status":"unaffected"},{"version":"11.8.6","status":"unaffected"},{"version":"11.7.11","status":"unaffected"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T21:41:15.727Z","modified_at":"2026-10-28T21:41:15.727Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93851","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:41:15.727Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://mattermost.com/security-updates","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T21:41:15.727Z","content_hash":"21d9c419df411333a61ce68fd012969023bae24810bcecb7adcbfca863603abe"}}