Is github.com/mattermost/mattermost-server/v6 safe ? github.com/mattermost/mattermost-server/v6 (go) has 47 known vulnerabilities, the worst rated HIGH. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 128 direct dependencies
26 carry known advisories, worst CRITICAL
1 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 51st percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-7664-hcp7-f497, the advisory selected below
// 47 advisories GHSA-7664-hcp7-f497 Mattermost webapp fails to validate route parameters in/<TEAMNAME/channels/<CHANNELNAME allowing an attacker to perform a client-side path traversal. HIGH GHSA-7g2v-2frm-rg94 Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin HIGH GHSA-32rp-q37p-jg6w Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated… HIGH GHSA-j6gg-r5jc-47cm Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the… MODE GHSA-qj47-w9f2-qg44 Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST… MODE GHSA-gq3r-5833-5532 Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import… MODE GHSA-x67c-v8jr-p29r Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file… MODE GHSA-h469-4fcf-p23h Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a… MODE GHSA-q453-638c-h4mr Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster… MODE GHSA-w88v-pjr8-cmv2 Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the… MODE Show all 47 advisories Mattermost webapp fails to validate route parameters in/<TEAMNAME/channels/<CHANNELNAME allowing an attacker to perform a client-side path traversal.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Scope Changed
Confidentiality Low
Integrity High
Availability Low // questions Is github.com/mattermost/mattermost-server/v6 safe to install? CyberXYZ does not call a package safe in absolute terms. It records 47 known vulnerabilities for github.com/mattermost/mattermost-server/v6 (go), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/mattermost/mattermost-server/v6 have known vulnerabilities? Yes. CyberXYZ records 47 known vulnerabilities for github.com/mattermost/mattermost-server/v6 (go), the worst rated HIGH. These include GHSA-7664-hcp7-f497, GHSA-7g2v-2frm-rg94, GHSA-32rp-q37p-jg6w, GHSA-j6gg-r5jc-47cm, GHSA-qj47-w9f2-qg44.
How do I check github.com/mattermost/mattermost-server/v6 before installing? Search github.com/mattermost/mattermost-server/v6 in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fmattermost%2Fmattermost-server%2Fv6 . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 11:05 UTC. The most recent advisory here was published 2025-11-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page