CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

Q: Is CVE-2026-14298 being exploited?

There is no known exploitation of CVE-2026-14298 in the wild and no public exploit code.

Medium 6.5 Published 13 Aug 2026 Updated 14 Sep 2026

An authenticated user can cause memory exhaustion or disk consumption in Mattermost by uploading a crafted archive file that bypasses size limits.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-14298?

CVE-2026-14298 is a medium-severity denial of service vulnerability in Mattermost Mattermost Server, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

Weakness: CWE-409

Which versions are affected by CVE-2026-14298?

It affects 1 product.

Products include Mattermost Mattermost Server.

How do I fix CVE-2026-14298?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-14298 being exploited?

There is no known exploitation of CVE-2026-14298 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as GHSA-hr32-2wx7-pp5r, MINI-jvxj-96v4-8p5c, MINI-m5j9-82rp-69gc.