CVE-2026-4054 in Mattermost
Summary
by MITRE • 05/16/2026
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/21/2026
This vulnerability exists in Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 due to insufficient validation of proxied image response bodies. The flaw occurs when Mattermost processes images through its proxy mechanism without properly validating the actual content type of the response body against the declared content type header. This represents a classic content type confusion vulnerability that falls under CWE-494, where the application accepts and processes data based on misleading metadata rather than actual content characteristics.
The technical exploitation involves an attacker serving malicious SVG content with a non-SVG content-type header such as image/png, which allows the SVG to be embedded in HTML meta tags like og:image or Markdown image links. When Mattermost proxies this content, it fails to verify that the actual response body matches the declared content type, enabling the execution of malicious SVG code that can trigger client-side denial of service conditions. This vulnerability specifically targets the image proxy functionality and represents a variant of CWE-502, where untrusted data is processed in a way that can lead to unexpected behavior.
The operational impact of this vulnerability is significant as it allows remote attackers to perform client-side denial of service attacks against Mattermost users. When users view channels containing maliciously crafted images, the SVG content can execute arbitrary code in the browser context, potentially leading to browser crashes, resource exhaustion, or other forms of service disruption. The attack vector is particularly dangerous because it can be delivered through standard user interactions like viewing posts with embedded images or visiting web pages that reference Mattermost content through open graph tags.
This vulnerability aligns with ATT&CK technique T1203, which describes exploitation of software vulnerabilities to gain access to systems or disrupt services. The specific attack pattern involves content injection through web-based interfaces and proxy mechanisms. Organizations using Mattermost should immediately apply the vendor-provided patches and updates to address this issue. Additionally, implementing proper content validation at the proxy layer, enforcing strict content-type checking, and deploying network-level protections such as web application firewalls can help mitigate the risk. The fix should include validation that ensures the actual content of proxied responses matches their declared content types, preventing the execution of potentially malicious content that could otherwise bypass normal security controls.