Go/github.com/mattermost/focalboard CVE-2026-28736: medium 4.3, EPSS 0.23%

Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5670
• nvd: CVE-2026-28736
• https://github.com/advisories/GHSA-vph7-r229-qxpf

CVE-2026-28736 · published 2026-06-25T22:34:38Z · modified 2026-06-25T23:01:38.778614136Z · JSON