Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-3108

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

VectorNETWORK

PublishedMar 26, 2026, 17:16

Published Byresponsibledisclosure@mattermost.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/mattermost/mattermost/server/v8(Go)11.4.0-rc111.4.1N/A

github.com/mattermost/mattermost/server/v8(Go)11.3.0-rc111.3.2N/A

github.com/mattermost/mattermost/server/v8(Go)11.2.0-rc111.2.3N/A

github.com/mattermost/mattermost/server/v8(Go)10.11.0-rc110.11.11N/A

github.com/mattermost/mattermost/server/v8(Go)8.0.0-20260105080200-d27a2195068d8.0.0-20260217110922-b7d4a1f1f59bN/A

References

https://mattermost.com/security-updates

Weakness Type

CWE-150

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK