CVE-2026-20719 MEDIUM

CVE-2026-20719: DoS via URL Previews Rendering Malicious SVGs

Vendor Mattermost
Product Mattermost
Weakness CWE-754
Published March 25, 2026
Last update March 26, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595

Key dates

02Disclosure timeline

March 25, 2026 CVE published
March 26, 2026 Record updated