CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
Mattermost MattermostApplications & CMS
CVSS
8.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- @thehackerwire.bsky.social: 🟠 CVE-2026-93851 - High (8) Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to valida... https://www.thehackerwire.com/vulnerability/CVE-202Bluesky: CVE posts, 28 Oct 2026
- 🚨 CVE-2026-93851 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenTelegram: CVE Notify, 28 Oct 2026
Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742
Text from CVE List
Affected versions 7
- Mattermostaffected: 11.9.0 through 11.9.1CVE List
- Mattermostaffected: 11.8.0 through 11.8.5CVE List
- Mattermostaffected: 11.7.0 through 11.7.10CVE List
- Mattermostunaffected: 11.10.0CVE List
- Mattermostunaffected: 11.9.2CVE List
- Mattermostunaffected: 11.8.6CVE List
- Mattermostunaffected: 11.7.11CVE List