更新: 413 个文件 - 2026-03-24 03:45:07

2026-03-24 03:45:08 -07:00
--- a/07-framework-security/platforms/mattermost/cases/mattermost-cve-2026-4265.md
+++ b/07-framework-security/platforms/mattermost/cases/mattermost-cve-2026-4265.md
@@ -1,13 +1,13 @@
 ---
-title: "MMSA-2025-00553"
+title: "Mattermost fails to validate team-specific upload_file permissions"
 system_id: "mattermost"
 category: "platforms"
 advisory_mode: "core"
-published_date: "2026-03-16"
-updated_date: "2026-03-16"
-severity: "medium"
+published_date: "2026-03-16T15:30:46Z"
+updated_date: "2026-03-23T18:56:04.837800Z"
+severity: "low"
 exploit_status: "unknown"
-source_confidence: "official"
+source_confidence: "ecosystem-authority"
 verification_status: "triage-manual"
 verification_mode: "synthetic"
 artifact_mode: "synthetic"
@@ -20,29 +20,39 @@ allow_public_validation: "yes, with ownership or explicit authorization"
 authorization_prerequisite: "asset ownership proof or explicit written authorization"
 minimal_validation: "read-only probe, controlled payload, reversible test"
 aliases:
-  - "MMSA-2025-00553"
  - "CVE-2026-4265"
+  - "GO-2026-4749"
+  - "GHSA-xpvf-6qcc-9jqc"
 affected_versions:
-  - "11.3.x <= 11.3.0"
-  - "11.2.x <= 11.2.2"
-  - "10.11.x <= 10.11.10"
+  - "introduced=0, fixed<8.0.0-20260107144005-c7f6efdfb035"
+  - "introduced=0, fixed<5.3.2-0.20260107144005-c7f6efdfb035"
+  - "introduced=10.11.0-rc1, fixed<10.11.11"
+  - "introduced=11.2.0-rc1, fixed<11.2.3"
+  - "introduced=11.3.0-rc1, fixed<11.3.1"
+  - "introduced=10.11.0-rc1+incompatible, fixed<10.11.11+incompatible"
+  - "introduced=0"
 fixed_versions:
-  - "11.4.0"
-  - "11.3.1"
-  - "11.2.3"
+  - "8.0.0-20260107144005-c7f6efdfb035"
+  - "5.3.2-0.20260107144005-c7f6efdfb035"
  - "10.11.11"
+  - "11.2.3"
+  - "11.3.1"
+  - "10.11.11+incompatible"
+  - "11.2.3+incompatible"
+  - "11.3.1+incompatible"
 entity_refs:
  - "mattermost:system:root-system"
-  - "mattermost--project--mattermost-server:project:affected-component"
+  - "mattermost--repo--github-com-mattermost-mattermost-server:repo:affected-component"
 secure_code_topics:
  - "authz-server-side-recheck"
  - "xss-output-encoding"
  - "token-cookie-storage"
  - "file-upload-validation"
-primary_source: "https://securityupdates.mattermost.com/security_updates.json"
+  - "dependency-upgrade-policy"
+primary_source: "https://nvd.nist.gov/vuln/detail/CVE-2026-4265"
 ---

-# MMSA-2025-00553
+# Mattermost fails to validate team-specific upload_file permissions

 ## 本地实证状态

@@ -57,35 +67,38 @@ primary_source: "https://securityupdates.mattermost.com/security_updates.json"

 - Canonical ID: `mattermost--CVE-2026-4265`
 - 系统: `mattermost`
- 严重度: `medium`
- 来源置信度: `official`
- 官方主源: https://securityupdates.mattermost.com/security_updates.json
- 影响版本: `11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10`
- 修复版本: `11.4.0, 11.3.1, 11.2.3, 10.11.11`
+- 严重度: `low`
+- 来源置信度: `ecosystem-authority`
+- 官方主源: https://nvd.nist.gov/vuln/detail/CVE-2026-4265
+- 影响版本: `introduced=0, fixed<8.0.0-20260107144005-c7f6efdfb035, introduced=0, fixed<5.3.2-0.20260107144005-c7f6efdfb035, introduced=10.11.0-rc1, fixed<10.11.11, introduced=11.2.0-rc1, fixed<11.2.3, introduced=11.3.0-rc1, fixed<11.3.1, introduced=10.11.0-rc1+incompatible, fixed<10.11.11+incompatible, introduced=0`
+- 修复版本: `8.0.0-20260107144005-c7f6efdfb035, 5.3.2-0.20260107144005-c7f6efdfb035, 10.11.11, 11.2.3, 11.3.1, 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible`

 ## 对象与版本映射

- Advisory Scope: `package`
- 影响对象: `Mattermost Server`
- Entity Refs: `mattermost, mattermost--project--mattermost-server`
+- Advisory Scope: `repo`
+- 影响对象: `mattermost / mattermost-server`
+- Entity Refs: `mattermost, mattermost--repo--github-com-mattermost-mattermost-server`
 - 版本置信度: `high`
 - 版本缺口: `-`
- 版本证据源: `https://securityupdates.mattermost.com/security_updates.json`
+- 版本证据源: `https://nvd.nist.gov/vuln/detail/CVE-2026-4265, https://github.com/advisories/GHSA-xpvf-6qcc-9jqc, https://github.com/mattermost/mattermost/commit/c7f6efdfb035490f494b3177996ee5f4b278c988, https://github.com/mattermost/mattermost, https://mattermost.com/security-updates`

 ## 受控验证流程

 - Workflow ID: `mattermost--CVE-2026-4265--workflow`
- 漏洞家族: `xss`
- 入口面: `web-ui-render-path`
- 需要角色: `editor-or-admin`
- 触发向量: 对 `xss` 家族入口投递最小化、可审计、可回滚的受控输入，比较修复前后差异。
- 请求/页面入口: `/admin/editor, /preview, /rendered-content`
- 输入形态: 受控 HTML/Markdown/富文本输入，观察渲染上下文是否失去编码或净化。
- 预期不安全行为: 输入在目标上下文执行或被浏览器解释为主动内容。
+- 漏洞家族: `unknown`
+- 入口面: `repo-surface`
+- 需要角色: `unknown`
+- 触发向量: 对 `unknown` 家族入口投递最小化、可审计、可回滚的受控输入，比较修复前后差异。
+- 请求/页面入口: `/repo`
+- 输入形态: 提交最小化、可审计、可回滚的受控输入。
+- 预期不安全行为: 目标表现出超出设计边界的行为。

 ## 其他来源

- 无额外来源
+- https://github.com/advisories/GHSA-xpvf-6qcc-9jqc
+- https://github.com/mattermost/mattermost/commit/c7f6efdfb035490f494b3177996ee5f4b278c988
+- https://github.com/mattermost/mattermost
+- https://mattermost.com/security-updates

 ## 证据点与补丁验证

@@ -111,10 +124,10 @@ primary_source: "https://securityupdates.mattermost.com/security_updates.json"

 ### 补丁验证步骤

- 确认目标版本从 `11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10` 升级或回移到 `11.4.0`。
+- 确认目标版本从 `introduced=0, fixed<8.0.0-20260107144005-c7f6efdfb035, introduced=0, fixed<5.3.2-0.20260107144005-c7f6efdfb035, introduced=10.11.0-rc1, fixed<10.11.11` 升级或回移到 `8.0.0-20260107144005-c7f6efdfb035`。
 - 保留同一组受控输入，在修复前后分别执行并比对响应、日志与浏览器证据。
 - 确认修复后仅保留预期业务行为，不再触发越权、回显、异常渲染或错误请求。
- 补充 `xss` 族自动化回归，避免同类路径在插件、主题或代理链中回归。
+- 补充 `unknown` 族自动化回归，避免同类路径在插件、主题或代理链中回归。

 ### 实验安全备注

@@ -164,3 +177,11 @@ primary_source: "https://securityupdates.mattermost.com/security_updates.json"
 - [ruby:file-upload-validation](/Users/x/websafe/05-defense/secure-code/ruby/file-upload-validation.md)
 - [csharp:file-upload-validation](/Users/x/websafe/05-defense/secure-code/csharp/file-upload-validation.md)
 - [go:file-upload-validation](/Users/x/websafe/05-defense/secure-code/go/file-upload-validation.md)
+- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
+- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
+- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
+- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
+- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
+- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
+- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
+- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)