EUVD-2026-49852

🗓️ 28 Jul 2026 13:58:31Reported by EUVDType

Mattermost versions eleven eight to ten eleven fail to verify file deletion path, enabling a SAML admin to delete files outside the config directory.

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2026-7521	28 Jul 202613:58	–	attackerkb
CVE	CVE-2026-7521	28 Jul 202613:58	–	cve
Cvelist	CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory	28 Jul 202613:58	–	cvelist
NVD	CVE-2026-7521	28 Jul 202615:17	–	nvd
Positive Technologies	PT-2026-65500	28 Jul 202600:00	–	ptsecurity

[
  {
    "enisaIdVendor": [
      {
        "id": "b0d0c5c2-b1e5-3ce1-88da-05e7bdba766a",
        "vendor": {
          "name": "Mattermost"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "39f71814-7edd-3581-98e3-c07eddaf2f7a",
        "product": {
          "name": "Mattermost",
          "vendor": {
            "name": "Mattermost"
          }
        },
        "product_version": "10.11.0 ≤10.11.20"
      },
      {
        "id": "529dc7b5-2b8c-35d6-b888-6ebd26ced3ab",
        "product": {
          "name": "Mattermost",
          "vendor": {
            "name": "Mattermost"
          }
        },
        "product_version": "11.8.0 ≤11.8.0"
      },
      {
        "id": "d734d9b4-3c4d-35be-93e6-db944d18c937",
        "product": {
          "name": "Mattermost",
          "vendor": {
            "name": "Mattermost"
          }
        },
        "product_version": "11.6.0 ≤11.6.5"
      },
      {
        "id": "dfd13eb3-b43b-3ced-9b04-19d11785a0bc",
        "product": {
          "name": "Mattermost",
          "vendor": {
            "name": "Mattermost"
          }
        },
        "product_version": "11.7.0 ≤11.7.3"
      }
    ]
  }
]

Source	Link
mattermost	www.mattermost.com/security-updates

28 Jul 2026 14:48Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.5