Mattermost Server is vulnerable to XSS via a Legal or Support setting

MEDIUM 6.1CVE-2016-11073 · GHSA-9jrx-fgrm-96qh · GO-2025-4056 · Published 19/06/2020 · updated 17/06/2026

In short

CVE-2016-11073 is a MEDIUM (CVSS 6.1) vulnerability affecting github.com/mattermost/mattermost-server, mattermost server (mattermost).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.9% of all vulnerabilities.
Fix: update to 3.0.0, 3.0.0+incompatible or later.

Package	Affected versions	Patched versions
github.com/mattermost/mattermost-server Go	`< 3.0.0< 3.0.0+incompatible`	`3.0.03.0.0+incompatible`
mattermost server mattermost	`< 3.0.0`	`3.0.0`

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.

NVD description

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 3.0.0< 3.0.0+incompatible

3.0.03.0.0+incompatible

< 3.0.0

3.0.0

More vulnerabilities in github.com/mattermost/mattermost-server

See all →