CVE-2017-18888: Mattermost Server SQL Injection Vulnerability in Multiple POST Requests
Summary
CVE-2017-18888: Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests. Affects github.com/mattermost/mattermost-server across 3 version ranges.
< 4.1.2
>= 4.2.0-rc1, < 4.2.1
>= 4.3.0-rc1, < 4.3.0
Fixed in 4.1.2, 4.2.1 or 4.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost Server is an open-source messaging platform designed for team collaboration. It provides features such as real-time messaging, file sharing, and integrations with other tools. The server is built using Go and is widely used by organizations for internal communication. However, prior to versions 4.3.0, 4.2.1, and 4.1.2, Mattermost Server was found to be vulnerable to SQL injection attacks, particularly during the fetching of multiple posts.
Vulnerability Detail
The vulnerability arises from improper handling of SQL queries when executing multiple POST requests. This flaw allows an attacker to manipulate SQL queries, potentially leading to unauthorized access to sensitive data, data corruption, or even complete system compromise. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
How To Fix
Latest published version: v11.9.0+incompatible as of 22 Oct 2026
go get github.com/mattermost/mattermost-server@v11.9.0+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.24.1.2go get github.com/mattermost/mattermost-server@v4.1.2 -
>= 4.2.0-rc1, < 4.2.14.2.1go get github.com/mattermost/mattermost-server@v4.2.1 -
>= 4.3.0-rc1, < 4.3.04.3.0go get github.com/mattermost/mattermost-server@v4.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to limit the number of POST requests made to the server until the update can be applied. Additionally, implementing input validation and sanitization on user inputs can help mitigate the risk of SQL injection attacks.
Conclusion
The SQL injection vulnerability in Mattermost Server poses a significant risk to users, allowing attackers to manipulate SQL queries through multiple POST requests. It is essential to update to the latest patched versions to mitigate this risk and ensure the security of your data.
See every vulnerability recorded for github.com/mattermost/mattermost-server →
FAQ
SQL injection is a code injection technique that exploits a vulnerability in an application's software by manipulating SQL queries. It allows attackers to execute arbitrary SQL code on a database.
You can check if your Mattermost Server is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive data, data corruption, or even a complete compromise of the Mattermost Server.
Yes, implementing input validation, using prepared statements, and employing ORM frameworks can help prevent SQL injection attacks.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server.
