{"id":"CVE-2026-93851","aliases":[],"title":"Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post","titleSource":"Mattermost","descriptionSource":"Mattermost","products":[{"vendor":"Mattermost","name":"Mattermost","platforms":[],"versions":[{"version":"11.9.0","status":"affected","lessThanOrEqual":"11.9.1","versionType":"semver"},{"version":"11.8.0","status":"affected","lessThanOrEqual":"11.8.5","versionType":"semver"},{"version":"11.7.0","status":"affected","lessThanOrEqual":"11.7.10","versionType":"semver"},{"version":"11.10.0","status":"unaffected"},{"version":"11.9.2","status":"unaffected"},{"version":"11.8.6","status":"unaffected"},{"version":"11.7.11","status":"unaffected"}],"defaultStatus":"unaffected","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93851"}],"remediation":[{"text":"Update Mattermost to versions 11.10.0, 11.9.2, 11.8.6, 11.7.11 or higher.","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93851"}],"description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742","severity":"high","score":8,"published":"2026-10-28T21:41:15.727Z","modified":"2026-10-28T21:41:15.727Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://mattermost.com/security-updates"],"sources":[{"name":"CVE","id":"CVE-2026-93851","modified":"2026-10-28T21:41:15.727Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93851"}],"assessments":[{"source":"Mattermost","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","score":8}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T06:00:31.558Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T22:55:37.457Z","attemptedAt":"2026-10-28T22:55:37.457Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T22:55:37.385Z","attemptedAt":"2026-10-28T22:55:37.385Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T22:55:38.049Z","attemptedAt":"2026-10-28T22:55:38.049Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T22:55:37.425Z","attemptedAt":"2026-10-28T22:55:37.425Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-93851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93851","modified":"2026-10-28T22:17:17.310","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","checkedAt":"2026-10-28T22:55:37.457Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112505","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112505","modified":"Oct 28, 2026, 9:41:15 PM","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","checkedAt":"2026-10-28T22:55:38.049Z"}]}