Mattermost contains a vulnerability in how it processes uploaded 7zip archives. In affected versions—Mattermost 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3—an authenticated attacker can upload a specially crafted 7zip file that is not properly validated, leading to server memory exhaustion and denial of service (DoS). The issue is tracked by Mattermost Advisory ID MMSA-2026-00573.
The root cause is failure to validate the internal structure of a 7zip archive before processing it. Specifically, the NVD description indicates the archive can be crafted with an excessive number of folder declarations, and because the server does not validate the archive structure up front, the processing path consumes excessive memory. The attack vector is network-based and requires authentication (PR:L), meaning the attacker must be able to interact with the Mattermost instance in an authenticated context and upload content that triggers 7zip handling. The exploitation mechanism is therefore: authenticate to Mattermost → upload a crafted 7zip archive with abnormal/excessive folder declarations → the server processes the archive without sufficient structural validation → memory exhaustion occurs → service becomes unavailable due to DoS.
Impact is primarily availability: an attacker can cause memory exhaustion leading to denial of service. The CVSS score is 4.3, rated “medium,” with the vector indicating network access, low attack complexity, and that no user interaction is required. Confidentiality and integrity are not indicated as impacted (C:N, I:N), and the scope is unchanged (S:U). Real-world risk depends on whether the attacker can authenticate and whether the instance allows uploads that are handled as 7zip archives; if so, the blast radius is the affected Mattermost server instance (potentially impacting all users until the condition is mitigated or the service is restarted).
Mitigation: upgrade Mattermost to a fixed version that includes MMSA-2026-00573. The NVD description identifies vulnerable ranges (11.5.x ≤ 11.5.1, 10.11.x ≤ 10.11.13, 11.4.x ≤ 11.4.3); therefore, patched versions should be those beyond these thresholds for the corresponding release lines. If immediate upgrading is not possible, reduce exposure by limiting authenticated users’ ability to upload archives (especially 7zip files) and monitor for upload attempts involving 7zip content that could trigger abnormal processing. Detection guidance should focus on signs of memory pressure and repeated failures during archive processing, but specific indicators (log messages, endpoints, or file metadata) are not provided in the supplied reference content.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-789