更新: 413 个文件 - 2026-03-24 03:45:07

07-framework-security/platforms/mattermost/cases/mattermost-cve-2026-22545.md

@@ -4,7 +4,7 @@ system_id: "mattermost"
 category: "platforms"
 advisory_mode: "core"
 published_date: "2026-03-16T15:30:47Z"
-updated_date: "2026-03-19T19:31:20.982512Z"
+updated_date: "2026-03-23T18:56:23.696710Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "ecosystem-authority"
@@ -21,6 +21,7 @@ authorization_prerequisite: "asset ownership proof or explicit written authoriza
 minimal_validation: "read-only probe, controlled payload, reversible test"
 aliases:
   - "CVE-2026-22545"
+  - "GO-2026-4786"
   - "GHSA-rv67-7w2g-7976"
 affected_versions:
   - "introduced=0, fixed<8.0.0-20260127144908-ced9a56e3988"
@@ -28,12 +29,17 @@ affected_versions:
   - "introduced=10.11.0-rc1, fixed<10.11.11"
   - "introduced=11.2.0-rc1, fixed<11.2.3"
   - "introduced=11.3.0-rc1, fixed<11.3.1"
+  - "introduced=10.11.0-rc1+incompatible, fixed<10.11.11+incompatible"
+  - "introduced=0"
 fixed_versions:
   - "8.0.0-20260127144908-ced9a56e3988"
   - "5.3.2-0.20260127144908-ced9a56e3988"
   - "10.11.11"
   - "11.2.3"
   - "11.3.1"
+  - "10.11.11+incompatible"
+  - "11.2.3+incompatible"
+  - "11.3.1+incompatible"
 entity_refs:
   - "mattermost:system:root-system"
   - "mattermost--repo--github-com-mattermost-mattermost-server:repo:affected-component"
@@ -63,8 +69,8 @@ primary_source: "https://nvd.nist.gov/vuln/detail/CVE-2026-22545"
 - 严重度: `low`
 - 来源置信度: `ecosystem-authority`
 - 官方主源: https://nvd.nist.gov/vuln/detail/CVE-2026-22545
-- 影响版本: `introduced=0, fixed<8.0.0-20260127144908-ced9a56e3988, introduced=0, fixed<5.3.2-0.20260127144908-ced9a56e3988, introduced=10.11.0-rc1, fixed<10.11.11, introduced=11.2.0-rc1, fixed<11.2.3, introduced=11.3.0-rc1, fixed<11.3.1`
-- 修复版本: `8.0.0-20260127144908-ced9a56e3988, 5.3.2-0.20260127144908-ced9a56e3988, 10.11.11, 11.2.3, 11.3.1`
+- 影响版本: `introduced=0, fixed<8.0.0-20260127144908-ced9a56e3988, introduced=0, fixed<5.3.2-0.20260127144908-ced9a56e3988, introduced=10.11.0-rc1, fixed<10.11.11, introduced=11.2.0-rc1, fixed<11.2.3, introduced=11.3.0-rc1, fixed<11.3.1, introduced=10.11.0-rc1+incompatible, fixed<10.11.11+incompatible, introduced=0`
+- 修复版本: `8.0.0-20260127144908-ced9a56e3988, 5.3.2-0.20260127144908-ced9a56e3988, 10.11.11, 11.2.3, 11.3.1, 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible`
 
 ## 对象与版本映射
 
@@ -73,21 +79,22 @@ primary_source: "https://nvd.nist.gov/vuln/detail/CVE-2026-22545"
 - Entity Refs: `mattermost, mattermost--repo--github-com-mattermost-mattermost-server`
 - 版本置信度: `high`
 - 版本缺口: `-`
-- 版本证据源: `https://nvd.nist.gov/vuln/detail/CVE-2026-22545, https://github.com/mattermost/mattermost/commit/ced9a56e3988fe9fd4559d45f9971dbd562e2218, https://github.com/mattermost/mattermost, https://mattermost.com/security-updates`
+- 版本证据源: `https://nvd.nist.gov/vuln/detail/CVE-2026-22545, https://github.com/advisories/GHSA-rv67-7w2g-7976, https://github.com/mattermost/mattermost/commit/ced9a56e3988fe9fd4559d45f9971dbd562e2218, https://github.com/mattermost/mattermost, https://mattermost.com/security-updates`
 
 ## 受控验证流程
 
 - Workflow ID: `mattermost--CVE-2026-22545--workflow`
-- 漏洞家族: `xss`
-- 入口面: `web-ui-render-path`
-- 需要角色: `editor-or-admin`
-- 触发向量: 对 `xss` 家族入口投递最小化、可审计、可回滚的受控输入，比较修复前后差异。
-- 请求/页面入口: `/admin/editor, /preview, /rendered-content`
-- 输入形态: 受控 HTML/Markdown/富文本输入，观察渲染上下文是否失去编码或净化。
-- 预期不安全行为: 输入在目标上下文执行或被浏览器解释为主动内容。
+- 漏洞家族: `unknown`
+- 入口面: `repo-surface`
+- 需要角色: `unknown`
+- 触发向量: 对 `unknown` 家族入口投递最小化、可审计、可回滚的受控输入，比较修复前后差异。
+- 请求/页面入口: `/repo`
+- 输入形态: 提交最小化、可审计、可回滚的受控输入。
+- 预期不安全行为: 目标表现出超出设计边界的行为。
 
 ## 其他来源
 
+- https://github.com/advisories/GHSA-rv67-7w2g-7976
 - https://github.com/mattermost/mattermost/commit/ced9a56e3988fe9fd4559d45f9971dbd562e2218
 - https://github.com/mattermost/mattermost
 - https://mattermost.com/security-updates
@@ -119,7 +126,7 @@ primary_source: "https://nvd.nist.gov/vuln/detail/CVE-2026-22545"
 - 确认目标版本从 `introduced=0, fixed<8.0.0-20260127144908-ced9a56e3988, introduced=0, fixed<5.3.2-0.20260127144908-ced9a56e3988, introduced=10.11.0-rc1, fixed<10.11.11` 升级或回移到 `8.0.0-20260127144908-ced9a56e3988`。
 - 保留同一组受控输入，在修复前后分别执行并比对响应、日志与浏览器证据。
 - 确认修复后仅保留预期业务行为，不再触发越权、回显、异常渲染或错误请求。
-- 补充 `xss` 族自动化回归，避免同类路径在插件、主题或代理链中回归。
+- 补充 `unknown` 族自动化回归，避免同类路径在插件、主题或代理链中回归。
 
 ### 实验安全备注