CVE-2026-7521 Overview
CVE-2026-7521 is a path traversal vulnerability [CWE-22] in Mattermost Server that allows an administrator with SAML system-console write permissions to delete arbitrary files outside the configuration directory. The flaw resides in the remove file endpoint, which fails to validate the file deletion path before executing the delete operation. Mattermost tracks this issue under advisory MMSA-2026-00666. Affected releases include 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, and 10.11.x <= 10.11.20.
Critical Impact
An authenticated administrator with SAML console write access can delete arbitrary files on the Mattermost server host, disrupting service availability and integrity.
Affected Products
- Mattermost Server 11.8.x up to and including 11.8.0
- Mattermost Server 11.7.x up to and including 11.7.3, and 11.6.x up to and including 11.6.5
- Mattermost Server 10.11.x up to and including 10.11.20
Discovery Timeline
- 2026-07-28 - CVE-2026-7521 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-7521
Vulnerability Analysis
The vulnerability exists in the Mattermost Server remove file endpoint used by the SAML configuration section of the system console. Administrators can upload and remove SAML-related files such as identity provider certificates and private keys. The remove operation accepts a file path parameter but does not verify that the target resolves inside the intended configuration directory. An administrator with SAML system-console write permissions can supply a path that escapes the config directory and points to any file readable by the Mattermost process.
Because the delete action executes with the privileges of the Mattermost service account, the attacker can remove binaries, logs, plugins, database files, or configuration artifacts on disk. This produces integrity loss and can lead to full service outage. The issue is classified as Path Traversal [CWE-22].
Root Cause
The root cause is missing canonicalization and boundary validation on the user-supplied file path. The server does not reject paths containing traversal sequences such as ../ and does not confirm the resolved path is a descendant of the SAML configuration directory before invoking the filesystem delete call.
Attack Vector
Exploitation is remote and requires an authenticated administrator with SAML system-console write permissions. The attacker sends a crafted request to the remove file endpoint with a path that traverses outside the config directory. No user interaction is required. Successful exploitation deletes the referenced file, impacting availability and integrity while not directly disclosing content.
See the Mattermost Security Updates advisory for technical details.
Detection Methods for CVE-2026-7521
Indicators of Compromise
- Requests to the SAML remove file API containing path traversal patterns such as ../, encoded variants like %2e%2e%2f, or absolute paths outside the Mattermost config directory.
- Unexpected deletion of files under Mattermost install paths, plugin directories, or system locations owned by the Mattermost service account.
- Audit log entries showing SAML certificate or key removal events immediately followed by service errors or missing-file exceptions.
Detection Strategies
- Enable and review Mattermost audit logs for saml and removeCertificate or equivalent file removal actions performed by administrator accounts.
- Alert when the same admin account triggers multiple file removal requests within a short window, especially outside change windows.
- Correlate web server access logs with filesystem change events on the Mattermost host to identify deletions that map back to console API calls.
Monitoring Recommendations
- Monitor administrative role changes granting SAML system-console write permissions and treat new grants as high-signal events.
- Track file integrity on the Mattermost config, plugins, and application binary directories using host-based file integrity monitoring.
- Forward Mattermost audit logs to a centralized data lake and build detections for path traversal tokens in request bodies to the remove file endpoint.
How to Mitigate CVE-2026-7521
Immediate Actions Required
- Upgrade Mattermost Server to a fixed release above 11.8.0, 11.7.3, 11.6.5, or 10.11.20 as published in the Mattermost security updates page.
- Audit all accounts with SAML system-console write permissions and remove the permission from accounts that do not require it.
- Rotate administrator credentials and API tokens if unexplained file deletions or SAML configuration changes are observed.
Patch Information
Mattermost has published fixed versions and remediation guidance under advisory MMSA-2026-00666. Refer to the Mattermost Security Updates page for the exact fixed build numbers and upgrade instructions.
Workarounds
- Restrict sysconsole_write_authentication_saml and equivalent SAML console write permissions to a minimal set of trusted administrators until patching is complete.
- Run the Mattermost service under a dedicated low-privilege account with filesystem access limited to required directories to reduce the blast radius of arbitrary deletion.
- Enable filesystem snapshots or backups of the Mattermost host so that deleted files can be restored quickly if exploitation occurs.
# Example: verify running Mattermost version before and after upgrade
mattermost version
# Example: list users with SAML system console write permission via mmctl
mmctl permissions role show system_admin | grep -i saml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
