CVE-2026-4054
published 2026-05-15CVE-2026-4054: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.24%
15.5th percentile
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0.0.0-20250731163400-5b955468ea1e < 0.0.0-20260414103857-b21ef302025e | 0.0.0-20260414103857-b21ef302025e |
| github.com | mattermost_mattermost-server | >= 11.4.0 < 11.4.4 | 11.4.4 |
| github.com | mattermost_mattermost-server | >= 11.5.0 < 11.5.2 | 11.5.2 |
| mattermost | mattermost | 10.11.0 – 10.11.13 | — |
| mattermost | mattermost | 11.4.0 – 11.4.3 | — |
| mattermost | mattermost | 11.5.0 – 11.5.1 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.14 | 10.11.14 |
| mattermost | mattermost_server | >= 11.4.0 < 11.4.4 | 11.4.4 |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.2 | 11.5.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 10.11.13/11.4.3/11.5.1/11.5.x SVG File unusual condition
vuldb·2026-05-16·CVSS 4.3
CVE-2026-4054 [MEDIUM] Mattermost up to 10.11.13/11.4.3/11.5.1/11.5.x SVG File unusual condition
A vulnerability, which was classified as problematic, has been found in Mattermost up to 10.11.13/11.4.3/11.5.1/11.5.x. Affected by this vulnerability is an unknown functionality of the component SVG File Handler. This manipulation causes improper check for unusual conditions.
The identification of this vulnerability is CVE-2026-4054. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Mattermost doesn't validate the response body of proxied images
ghsa·2026-05-15
CVE-2026-4054 [MEDIUM] CWE-754 Mattermost doesn't validate the response body of proxied images
Mattermost doesn't validate the response body of proxied images
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link. Mattermost Advisory ID: MMSA-2026-00630.
GHSA
GHSA-j76w-p754-g2w7: Mattermost versions 11
ghsa_unreviewed·2026-05-15
CVE-2026-4054 [MEDIUM] CWE-754 GHSA-j76w-p754-g2w7: Mattermost versions 11
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-15
Published