{"action":"Upgrade github.com/mattermost/mattermost-server to 0.0.0-20260414103857-b21ef302025e or later.","affected":[{"fixed":"0.0.0-20260414103857-b21ef302025e","introduced":"0.0.0-20250731163400-5b955468ea1e"},{"fixed":"11.4.4+incompatible","introduced":"11.4.0+incompatible"},{"fixed":"11.5.2+incompatible","introduced":"11.5.0+incompatible"}],"component":"github.com/mattermost/mattermost-server","cve_ids":["CVE-2026-4054"],"ecosystem":"Go","epss":0.00242,"exploited":false,"fixed_versions":["0.0.0-20260414103857-b21ef302025e","11.4.4+incompatible","11.5.2+incompatible"],"ghsa_id":"GHSA-j76w-p754-g2w7","id":"tcs_01M5KGMD3ST582C6N12J7XW6WW","modified_at":"2026-06-25T23:01:17.183161047Z","published_at":"2026-06-25T22:34:31Z","references":["https://osv.dev/vulnerability/GO-2026-5454","https://github.com/advisories/GHSA-j76w-p754-g2w7","https://nvd.nist.gov/vuln/detail/CVE-2026-4054","https://mattermost.com/security-updates"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GO-2026-5454","url":"https://osv.dev/vulnerability/GO-2026-5454"},{"source":"nvd","source_id":"CVE-2026-4054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4054"}],"summary":"Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server"}