x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-8qg8-c7mw-6fj7

Advisory [GHSA-8qg8-c7mw-6fj7](https://github.com/advisories/GHSA-8qg8-c7mw-6fj7) references a vulnerability in the following Go modules:

| Module |
| - |
| [github.com/mattermost/mattermost-server](https://pkg.go.dev/github.com/mattermost/mattermost-server) |

Description:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.

References:
- ADVISORY: https://github.com/advisories/GHSA-8qg8-c7mw-6fj7
- ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2017-18874
- FIX: https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086
- FIX: https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa
- FIX: https://github.com/mattermost/mattermost/commit/fadd9514f6e71590aba781a7035e1de4150137b0
- WEB: https://mattermost.com/security-updates

Cross references:
- github.com/mattermost/mattermost-server appears in 167 other report(s):
  - data/excluded/GO-2022-0601.yaml    (https://github.com/golang/vulndb/issues/601)    EFFECTIVELY_PRIVATE
  - data/excluded/GO-2022-1126.yaml    (https://github.com/golang/vulndb/issues/1126)    EFFECTIVELY_PRIVATE
  - data/excluded/GO-2022-1127.yaml    (https://github.com/golang/vulndb/issues/1127)    EFFECTIVELY_PRIVATE
  - data/excluded/GO-2023-1710.yaml    (https://github.com/golang/vulndb/issues/1710)    EFFECTIVELY_PRIVATE
  - data/reports/GO-2022-0540.yaml    (https://github.com/golang/vulndb/issues/540)
  - data/reports/GO-2022-0576.yaml    (https://github.com/golang/vulndb/issues/576)
  - data/reports/GO-2022-0595.yaml    (https://github.com/golang/vulndb/issues/595)
  - data/reports/GO-2022-0599.yaml    (https://github.com/golang/vulndb/issues/599)
  - data/reports/GO-2022-0604.yaml    (https://github.com/golang/vulndb/issues/604)
  - data/reports/GO-2022-0616.yaml    (https://github.com/golang/vulndb/issues/616)
  - data/reports/GO-2023-1939.yaml    (https://github.com/golang/vulndb/issues/1939)
  - data/reports/GO-2024-2444.yaml    (https://github.com/golang/vulndb/issues/2444)
  - data/reports/GO-2024-2446.yaml    (https://github.com/golang/vulndb/issues/2446)
  - data/reports/GO-2024-2448.yaml    (https://github.com/golang/vulndb/issues/2448)
  - data/reports/GO-2024-2450.yaml    (https://github.com/golang/vulndb/issues/2450)
  - data/reports/GO-2024-2541.yaml    (https://github.com/golang/vulndb/issues/2541)
  - data/reports/GO-2024-2566.yaml    (https://github.com/golang/vulndb/issues/2566)
  - data/reports/GO-2024-2588.yaml    (https://github.com/golang/vulndb/issues/2588)
  - data/reports/GO-2024-2589.yaml    (https://github.com/golang/vulndb/issues/2589)
  - data/reports/GO-2024-2590.yaml    (https://github.com/golang/vulndb/issues/2590)
  - data/reports/GO-2024-2591.yaml    (https://github.com/golang/vulndb/issues/2591)
  - data/reports/GO-2024-2592.yaml    (https://github.com/golang/vulndb/issues/2592)
  - data/reports/GO-2024-2593.yaml    (https://github.com/golang/vulndb/issues/2593)
  - data/reports/GO-2024-2594.yaml    (https://github.com/golang/vulndb/issues/2594)
  - data/reports/GO-2024-2595.yaml    (https://github.com/golang/vulndb/issues/2595)
  - data/reports/GO-2024-2635.yaml    (https://github.com/golang/vulndb/issues/2635)
  - data/reports/GO-2024-2695.yaml    (https://github.com/golang/vulndb/issues/2695)
  - data/reports/GO-2024-2696.yaml    (https://github.com/golang/vulndb/issues/2696)
  - data/reports/GO-2024-2706.yaml    (https://github.com/golang/vulndb/issues/2706)
  - data/reports/GO-2024-2707.yaml    (https://github.com/golang/vulndb/issues/2707)
  - data/reports/GO-2024-2793.yaml    (https://github.com/golang/vulndb/issues/2793)
  - data/reports/GO-2024-2794.yaml    (https://github.com/golang/vulndb/issues/2794)
  - data/reports/GO-2024-2795.yaml    (https://github.com/golang/vulndb/issues/2795)
  - data/reports/GO-2024-2796.yaml    (https://github.com/golang/vulndb/issues/2796)
  - data/reports/GO-2024-2797.yaml    (https://github.com/golang/vulndb/issues/2797)
  - data/reports/GO-2024-2798.yaml    (https://github.com/golang/vulndb/issues/2798)
  - data/reports/GO-2024-3020.yaml    (https://github.com/golang/vulndb/issues/3020)
  - data/reports/GO-2024-3022.yaml    (https://github.com/golang/vulndb/issues/3022)
  - data/reports/GO-2024-3023.yaml    (https://github.com/golang/vulndb/issues/3023)
  - data/reports/GO-2024-3024.yaml    (https://github.com/golang/vulndb/issues/3024)
  - data/reports/GO-2024-3025.yaml    (https://github.com/golang/vulndb/issues/3025)
  - data/reports/GO-2024-3028.yaml    (https://github.com/golang/vulndb/issues/3028)
  - data/reports/GO-2024-3030.yaml    (https://github.com/golang/vulndb/issues/3030)
  - data/reports/GO-2024-3031.yaml    (https://github.com/golang/vulndb/issues/3031)
  - data/reports/GO-2024-3032.yaml    (https://github.com/golang/vulndb/issues/3032)
  - data/reports/GO-2024-3089.yaml    (https://github.com/golang/vulndb/issues/3089)
  - data/reports/GO-2024-3090.yaml    (https://github.com/golang/vulndb/issues/3090)
  - data/reports/GO-2024-3091.yaml    (https://github.com/golang/vulndb/issues/3091)
  - data/reports/GO-2024-3092.yaml    (https://github.com/golang/vulndb/issues/3092)
  - data/reports/GO-2024-3093.yaml    (https://github.com/golang/vulndb/issues/3093)
  - data/reports/GO-2024-3094.yaml    (https://github.com/golang/vulndb/issues/3094)
  - data/reports/GO-2024-3096.yaml    (https://github.com/golang/vulndb/issues/3096)
  - data/reports/GO-2024-3097.yaml    (https://github.com/golang/vulndb/issues/3097)
  - data/reports/GO-2024-3164.yaml    (https://github.com/golang/vulndb/issues/3164)
  - data/reports/GO-2024-3227.yaml    (https://github.com/golang/vulndb/issues/3227)
  - data/reports/GO-2024-3232.yaml    (https://github.com/golang/vulndb/issues/3232)
  - data/reports/GO-2024-3233.yaml    (https://github.com/golang/vulndb/issues/3233)
  - data/reports/GO-2024-3234.yaml    (https://github.com/golang/vulndb/issues/3234)
  - data/reports/GO-2024-3235.yaml    (https://github.com/golang/vulndb/issues/3235)
  - data/reports/GO-2024-3334.yaml    (https://github.com/golang/vulndb/issues/3334)
  - data/reports/GO-2024-3337.yaml    (https://github.com/golang/vulndb/issues/3337)
  - data/reports/GO-2024-3338.yaml    (https://github.com/golang/vulndb/issues/3338)
  - data/reports/GO-2024-3340.yaml    (https://github.com/golang/vulndb/issues/3340)
  - data/reports/GO-2025-3377.yaml    (https://github.com/golang/vulndb/issues/3377)
  - data/reports/GO-2025-3379.yaml    (https://github.com/golang/vulndb/issues/3379)
  - data/reports/GO-2025-3380.yaml    (https://github.com/golang/vulndb/issues/3380)
  - data/reports/GO-2025-3392.yaml    (https://github.com/golang/vulndb/issues/3392)
  - data/reports/GO-2025-3393.yaml    (https://github.com/golang/vulndb/issues/3393)
  - data/reports/GO-2025-3394.yaml    (https://github.com/golang/vulndb/issues/3394)
  - data/reports/GO-2025-3407.yaml    (https://github.com/golang/vulndb/issues/3407)
  - data/reports/GO-2025-3480.yaml    (https://github.com/golang/vulndb/issues/3480)
  - data/reports/GO-2025-3481.yaml    (https://github.com/golang/vulndb/issues/3481)
  - data/reports/GO-2025-3482.yaml    (https://github.com/golang/vulndb/issues/3482)
  - data/reports/GO-2025-3483.yaml    (https://github.com/golang/vulndb/issues/3483)
  - data/reports/GO-2025-3534.yaml    (https://github.com/golang/vulndb/issues/3534)
  - data/reports/GO-2025-3549.yaml    (https://github.com/golang/vulndb/issues/3549)
  - data/reports/GO-2025-3550.yaml    (https://github.com/golang/vulndb/issues/3550)
  - data/reports/GO-2025-3551.yaml    (https://github.com/golang/vulndb/issues/3551)
  - data/reports/GO-2025-3552.yaml    (https://github.com/golang/vulndb/issues/3552)
  - data/reports/GO-2025-3555.yaml    (https://github.com/golang/vulndb/issues/3555)
  - data/reports/GO-2025-3556.yaml    (https://github.com/golang/vulndb/issues/3556)
  - data/reports/GO-2025-3604.yaml    (https://github.com/golang/vulndb/issues/3604)
  - data/reports/GO-2025-3609.yaml    (https://github.com/golang/vulndb/issues/3609)
  - data/reports/GO-2025-3610.yaml    (https://github.com/golang/vulndb/issues/3610)
  - data/reports/GO-2025-3611.yaml    (https://github.com/golang/vulndb/issues/3611)
  - data/reports/GO-2025-3618.yaml    (https://github.com/golang/vulndb/issues/3618)
  - data/reports/GO-2025-3619.yaml    (https://github.com/golang/vulndb/issues/3619)
  - data/reports/GO-2025-3620.yaml    (https://github.com/golang/vulndb/issues/3620)
  - data/reports/GO-2025-3621.yaml    (https://github.com/golang/vulndb/issues/3621)
  - data/reports/GO-2025-3622.yaml    (https://github.com/golang/vulndb/issues/3622)
  - data/reports/GO-2025-3623.yaml    (https://github.com/golang/vulndb/issues/3623)
  - data/reports/GO-2025-3642.yaml    (https://github.com/golang/vulndb/issues/3642)
  - data/reports/GO-2025-3642.yaml    (https://github.com/golang/vulndb/issues/3642)
  - data/reports/GO-2025-3642.yaml    (https://github.com/golang/vulndb/issues/3642)
  - data/reports/GO-2025-3643.yaml    (https://github.com/golang/vulndb/issues/3643)
  - data/reports/GO-2025-3643.yaml    (https://github.com/golang/vulndb/issues/3643)
  - data/reports/GO-2025-3643.yaml    (https://github.com/golang/vulndb/issues/3643)
  - data/reports/GO-2025-3644.yaml    (https://github.com/golang/vulndb/issues/3644)
  - data/reports/GO-2025-3644.yaml    (https://github.com/golang/vulndb/issues/3644)
  - data/reports/GO-2025-3644.yaml    (https://github.com/golang/vulndb/issues/3644)
  - data/reports/GO-2025-3691.yaml    (https://github.com/golang/vulndb/issues/3691)
  - data/reports/GO-2025-3692.yaml    (https://github.com/golang/vulndb/issues/3692)
  - data/reports/GO-2025-3693.yaml    (https://github.com/golang/vulndb/issues/3693)
  - data/reports/GO-2025-3694.yaml    (https://github.com/golang/vulndb/issues/3694)
  - data/reports/GO-2025-3724.yaml    (https://github.com/golang/vulndb/issues/3724)
  - data/reports/GO-2025-3728.yaml    (https://github.com/golang/vulndb/issues/3728)
  - data/reports/GO-2025-3729.yaml    (https://github.com/golang/vulndb/issues/3729)
  - data/reports/GO-2025-3730.yaml    (https://github.com/golang/vulndb/issues/3730)
  - data/reports/GO-2025-3731.yaml    (https://github.com/golang/vulndb/issues/3731)
  - data/reports/GO-2025-3756.yaml    (https://github.com/golang/vulndb/issues/3756)
  - data/reports/GO-2025-3757.yaml    (https://github.com/golang/vulndb/issues/3757)
  - data/reports/GO-2025-3769.yaml    (https://github.com/golang/vulndb/issues/3769)
  - data/reports/GO-2025-3771.yaml    (https://github.com/golang/vulndb/issues/3771)
  - data/reports/GO-2025-3772.yaml    (https://github.com/golang/vulndb/issues/3772)
  - data/reports/GO-2025-3796.yaml    (https://github.com/golang/vulndb/issues/3796)
  - data/reports/GO-2025-3797.yaml    (https://github.com/golang/vulndb/issues/3797)
  - data/reports/GO-2025-3818.yaml    (https://github.com/golang/vulndb/issues/3818)
  - data/reports/GO-2025-3819.yaml    (https://github.com/golang/vulndb/issues/3819)
  - data/reports/GO-2025-3820.yaml    (https://github.com/golang/vulndb/issues/3820)
  - data/reports/GO-2025-3901.yaml    (https://github.com/golang/vulndb/issues/3901)
  - data/reports/GO-2025-3902.yaml    (https://github.com/golang/vulndb/issues/3902)
  - data/reports/GO-2025-3903.yaml    (https://github.com/golang/vulndb/issues/3903)
  - data/reports/GO-2025-3904.yaml    (https://github.com/golang/vulndb/issues/3904)
  - data/reports/GO-2025-3905.yaml    (https://github.com/golang/vulndb/issues/3905)
  - data/reports/GO-2025-3906.yaml    (https://github.com/golang/vulndb/issues/3906)
  - data/reports/GO-2025-3907.yaml    (https://github.com/golang/vulndb/issues/3907)
  - data/reports/GO-2025-3910.yaml    (https://github.com/golang/vulndb/issues/3910)
  - data/reports/GO-2025-3911.yaml    (https://github.com/golang/vulndb/issues/3911)
  - data/reports/GO-2025-3950.yaml    (https://github.com/golang/vulndb/issues/3950)
  - data/reports/GO-2025-3958.yaml    (https://github.com/golang/vulndb/issues/3958)
  - data/reports/GO-2025-3959.yaml    (https://github.com/golang/vulndb/issues/3959)
  - data/reports/GO-2025-3960.yaml    (https://github.com/golang/vulndb/issues/3960)
  - data/reports/GO-2025-3977.yaml    (https://github.com/golang/vulndb/issues/3977)
  - data/reports/GO-2025-3978.yaml    (https://github.com/golang/vulndb/issues/3978)
  - data/reports/GO-2025-4029.yaml    (https://github.com/golang/vulndb/issues/4029)
  - data/reports/GO-2025-4030.yaml    (https://github.com/golang/vulndb/issues/4030)
  - data/reports/GO-2025-4031.yaml    (https://github.com/golang/vulndb/issues/4031)
  - data/reports/GO-2025-4032.yaml    (https://github.com/golang/vulndb/issues/4032)
  - data/reports/GO-2025-4035.yaml    (https://github.com/golang/vulndb/issues/4035)
  - data/reports/GO-2025-4036.yaml    (https://github.com/golang/vulndb/issues/4036)
  - data/reports/GO-2025-4045.yaml    (https://github.com/golang/vulndb/issues/4045)
  - data/reports/GO-2025-4046.yaml    (https://github.com/golang/vulndb/issues/4046)
  - data/reports/GO-2025-4047.yaml    (https://github.com/golang/vulndb/issues/4047)
  - data/reports/GO-2025-4048.yaml    (https://github.com/golang/vulndb/issues/4048)
  - data/reports/GO-2025-4050.yaml    (https://github.com/golang/vulndb/issues/4050)
  - data/reports/GO-2025-4051.yaml    (https://github.com/golang/vulndb/issues/4051)
  - data/reports/GO-2025-4053.yaml    (https://github.com/golang/vulndb/issues/4053)
  - data/reports/GO-2025-4054.yaml    (https://github.com/golang/vulndb/issues/4054)
  - data/reports/GO-2025-4055.yaml    (https://github.com/golang/vulndb/issues/4055)
  - data/reports/GO-2025-4056.yaml    (https://github.com/golang/vulndb/issues/4056)
  - data/reports/GO-2025-4057.yaml    (https://github.com/golang/vulndb/issues/4057)
  - data/reports/GO-2025-4058.yaml    (https://github.com/golang/vulndb/issues/4058)
  - data/reports/GO-2025-4059.yaml    (https://github.com/golang/vulndb/issues/4059)
  - data/reports/GO-2025-4060.yaml    (https://github.com/golang/vulndb/issues/4060)
  - data/reports/GO-2025-4061.yaml    (https://github.com/golang/vulndb/issues/4061)
  - data/reports/GO-2025-4062.yaml    (https://github.com/golang/vulndb/issues/4062)
  - data/reports/GO-2025-4063.yaml    (https://github.com/golang/vulndb/issues/4063)
  - data/reports/GO-2025-4064.yaml    (https://github.com/golang/vulndb/issues/4064)
  - data/reports/GO-2025-4065.yaml    (https://github.com/golang/vulndb/issues/4065)
  - data/reports/GO-2025-4066.yaml    (https://github.com/golang/vulndb/issues/4066)
  - data/reports/GO-2025-4075.yaml    (https://github.com/golang/vulndb/issues/4075)
  - data/reports/GO-2025-4122.yaml    (https://github.com/golang/vulndb/issues/4122)
  - data/reports/GO-2025-4126.yaml    (https://github.com/golang/vulndb/issues/4126)
  - data/reports/GO-2025-4128.yaml    (https://github.com/golang/vulndb/issues/4128)
  - data/reports/GO-2025-4129.yaml    (https://github.com/golang/vulndb/issues/4129)
  - data/reports/GO-2025-4130.yaml    (https://github.com/golang/vulndb/issues/4130)
  - data/reports/GO-2025-4131.yaml    (https://github.com/golang/vulndb/issues/4131)

See [doc/quickstart.md](https://github.com/golang/vulndb/blob/master/doc/quickstart.md) for instructions on how to triage this report.

```
id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - introduced: 4.2.0-rc1+incompatible
        - introduced: 4.3.0-rc1+incompatible
        - fixed: 4.3.0+incompatible
      non_go_versions:
        - fixed: 4.1.2-0.20171004201910-6be8113eb60
        - fixed: 4.2.1-0.20171004194140-6d3cb2ce07fc
      vulnerable_at: 4.3.0-rc4+incompatible
summary: Mattermost Server is vulnerable to Directory Traversal by System Admins in github.com/mattermost/mattermost-server
cves:
    - CVE-2017-18874
ghsas:
    - GHSA-8qg8-c7mw-6fj7
references:
    - advisory: https://github.com/advisories/GHSA-8qg8-c7mw-6fj7
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2017-18874
    - fix: https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086
    - fix: https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa
    - fix: https://github.com/mattermost/mattermost/commit/fadd9514f6e71590aba781a7035e1de4150137b0
    - web: https://mattermost.com/security-updates
source:
    id: GHSA-8qg8-c7mw-6fj7
    created: 2025-11-20T22:01:45.534866931Z
review_status: UNREVIEWED

```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-8qg8-c7mw-6fj7 #4148

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-8qg8-c7mw-6fj7 #4148

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions