## Summary
Mattermost contains a path traversal issue in the integration action URL handling that can allow a malicious authenticated user to call an arbitrary API using the system admin Mattermost auth token. The issue affects Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 (Mattermost Advisory MMSA-2026-00640).
## Technical Details
- Root cause (per advisory summary): Mattermost fails to check the integration URL for path traversal.
- Attack technique: By supplying a crafted integration action URL containing traversal sequences, an attacker can reach unintended internal API endpoints.
- Privilege impact: The traversal enables the attacker to invoke arbitrary APIs via the system admin Mattermost auth token.
- Preconditions (from CVSS vector and NVD text):
- Network-reachable attack (AV:N).
- Requires user interaction (UI:R) and limited privileges (PR:L).
- Attacker must be authenticated (malicious authenticated user).
## Affected
- mattermost server versions:
- 11.6.x <= 11.6.0
- 11.5.x <= 11.5.3
- 11.4.x <= 11.4.4
- 10.11.x <= 10.11.14
## Impact
- High impact with confidentiality, integrity, and availability consequences (C:H/I:H/A:H in the provided CVSS).
- Potential for unauthorized API access and actions performed with system-admin-level authorization (token misuse).
## Mitigation
1. Review Mattermost security guidance for MMSA-2026-00640 and apply the vendor’s recommended fixed version/patch for the affected release lines.
2. Restrict who can create or configure integrations/actions to reduce the likelihood of a malicious authenticated user reaching the vulnerable URL handling path.
3. Monitor for suspicious integration action URL patterns consistent with path traversal attempts (e.g., traversal-like sequences) and investigate anomalous internal API calls originating from integration contexts.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-22