VDB
Sign up
LOW3.1

GHSA-g3v6-r8p9-wxg9

Mattermost fails to correctly delete attachments

Quick fix

GHSA-g3v6-r8p9-wxg9 — github.com/mattermost/mattermost-server/v6: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-server/v6@v7.9.6

Details

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost-server/v6
Introduced in: 7.9.0Fixed in: 7.9.6
Fixgo get github.com/mattermost/mattermost-server/v6@v7.9.6
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 7.10.0Fixed in: 7.10.4
Fixgo get github.com/mattermost/mattermost-server/v6@v7.10.4
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 0Fixed in: 7.8.8
Fixgo get github.com/mattermost/mattermost-server/v6@v7.8.8

References