tocsin

Go/github.com/mattermost/mattermost/server/v8 CVE-2026-3495: low 3.8, EPSS 0.14%

Mattermost doesn't escape some variables that could contain malicious content during error page composition

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260310115442-5a1ea95044d or later.

go get github.com/mattermost/mattermost/server/v8@v10.11.14
go get github.com/mattermost/mattermost/server/v8@v11.5.2
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260310115442-5a1ea95044d

Affected

introducedfixedlast affected
10.11.010.11.14-
11.5.011.5.2-
08.0.0-20260310115442-5a1ea95044d-

Fixed versions

10.11.1411.5.28.0.0-20260310115442-5a1ea95044d

Sources

CVE-2026-3495 · published · modified · JSON