MEDIUM5.4
GHSA-63f2-6959-2pxj
Mattermost vulnerable to cross-site scripting (XSS)
Quick fix
GHSA-63f2-6959-2pxj — github.com/mattermost/mattermost-server/v6: upgrade to the fixed version with the command below.
go get github.com/mattermost/mattermost-server/v6@v7.1.6Details
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.
[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00139
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/mattermost/mattermost-server/v6
Introduced in:
6.0.0Fixed in: 7.1.6Fix
go get github.com/mattermost/mattermost-server/v6@v7.1.6Go/github.com/mattermost/mattermost-server
Introduced in:
7.7.0Fixed in: 7.7.2Fix
go get github.com/mattermost/mattermost-server@v7.7.2Go/github.com/mattermost/mattermost-server
Introduced in:
7.1.0Fixed in: 7.1.6Fix
go get github.com/mattermost/mattermost-server@v7.1.6Go/github.com/mattermost/mattermost-server
Introduced in:
7.8.0Fixed in: 7.8.1Fix
go get github.com/mattermost/mattermost-server@v7.8.1Go/github.com/mattermost/mattermost-server/v5
Introduced in:
5.0.0Fixed in: 7.1.6Fix
go get github.com/mattermost/mattermost-server/v5@v7.1.6Go/github.com/mattermost/mattermost-server/v6
Introduced in:
3.3.0Fixed in: 7.1.6Fix
go get github.com/mattermost/mattermost-server/v6@v7.1.6