Moderate severityNVD Advisory· Published Mar 25, 2026· Updated Mar 26, 2026
DoS via URL Previews Rendering Malicious SVGs
CVE-2026-20719
Description
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go | >= 11.4.0-rc1, < 11.4.1 | 11.4.1 |
github.com/mattermost/mattermost/server/v8Go | >= 11.3.0-rc1, < 11.3.2 | 11.3.2 |
github.com/mattermost/mattermost/server/v8Go | >= 11.2.0-rc1, < 11.2.4 | 11.2.4 |
github.com/mattermost/mattermost/server/v8Go | >= 8.0.0-20260105080200-d27a2195068d, < 8.0.0-20260217110922-b7d4a1f1f59b | 8.0.0-20260217110922-b7d4a1f1f59b |
github.com/mattermost/mattermost/server/v8Go | >= 10.11.0-rc1, < 10.11.2 | 10.11.2 |
Affected products
1- Range: 11.4.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-86vc-mg26-fj6xghsaADVISORY
- mattermost.com/security-updatesghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-20719ghsaADVISORY
News mentions
0No linked articles in our index yet.