49 matches found
CVE-2025-25279-Mattermost-Path-Traversal
π₯ CVE-2025-25279 β Mattermost 10.4.1 π€ Focalboardμ κ²½λ‘ νμμ ν΅ν νμΌ μ μΆ π μκ° μ΄ κ°λ μ¦λͺ μ Mattermost 10.4.1 μ μν₯μ λ―ΈμΉλ CVE-2025-25279 μ·¨μ½μ μ μ μ©μ 보μ¬μ€λλ€. Focalboard보λ κ΄λ¦¬ λͺ¨λμ κ²°ν¨μΌλ‘ μΈν΄ μ²¨λΆ νμΌμ κ²½λ‘ νμ μ ν΅ν μμ νμΌ μ½κΈ° κ° κ°λ₯ν©λλ€. μ΅μ€νλ‘μμ λ€μμ μ μΆν μ μμ΅λλ€: /etc/passwd /etc/group λλ Mattermostμ λ―Όκ°ν νμΌμ:...
SUSE CVE-2026-25773
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...
SUSE CVE-2026-28736
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
GO-2026-5670 Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard
Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard...
GO-2026-5524 Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements in github.com/mattermost/focalboard
Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements in github.com/mattermost/focalboard...
The vulnerability of the Boards API (Focalboard) interface of the Mattermost instant messaging application, which allows a malicious user to gain unauthorized access to protected information.
The vulnerability of the Boards API Focalboard interface of the Mattermost instant messaging application relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...
SQL Injection
Focalboard is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of category IDs before they are incorporated into dynamic SQL statements, which allows an attacker to inject malicious SQL that is later executed and used to extract sensitive data from the database...
Exploit for Path Traversal in Mattermost Mattermost_Server
π₯ CVE-2025-25279 β Mattermost 10.4.1 π€ Path Traversal dan...
CVE-2026-28736
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
CVE-2026-25773
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...
EUVD-2026-18653
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...
GHSA-P32Q-V29X-WQ9R Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...
EUVD-2026-18651
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...
GHSA-VPH7-R229-QXPF Focalboard doesn't validate file ownership when serving uploaded files
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
Focalboard doesn't validate file ownership when serving uploaded files
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the file content endpoint. An attacker can access files belonging to other users by supplying a valid file identifier associated with the target user's files. Note: Vendor's statement...
CVE-2026-25773
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...
CVE-2026-28736
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
CVE-2026-28736
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...