CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory
An admin with SAML write permissions can delete arbitrary files outside the config directory via path traversal in the file removal endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7521?
CVE-2026-7521 is a medium-severity path traversal vulnerability in Mattermost Mattermost Server, published on 28 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666
Weakness: CWE-22
Which versions are affected by CVE-2026-7521?
It affects 1 product.
Products include Mattermost Mattermost Server.
How do I fix CVE-2026-7521?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-7521 being exploited?
There is no known exploitation of CVE-2026-7521 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Mattermost Server
- CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
- CVE-2025-12421 Account Takeover via Code Exchange Endpoint
- CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
- CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards
- CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive
Sources
Also known as GHSA-rxgw-2f9c-c2hh, MINI-7r3m-mgh4-7rcv, MINI-h6v7-fjgp-5fxv.