Go/github.com/mattermost/mattermost/server/v8 CVE-2026-4915: medium 6.5, EPSS 0.28%

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260407102538-faa7d75b4ea0 or later.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260407102538-faa7d75b4ea0

Affected

Fixed versions

Sources

• osv: GHSA-5gmf-x7hg-97wf#Go/github.com/mattermost/mattermost/server/v8
• https://nvd.nist.gov/vuln/detail/CVE-2026-4915
• https://github.com/mattermost/mattermost/commit/faa7d75b4ea041701e97948f8aa1332e3626a39a
• https://github.com/mattermost/mattermost
• https://mattermost.com/security-updates

CVE-2026-4915 · published 2026-05-26T13:30:40Z · modified 2026-07-07T16:11:26.107537868Z · JSON