CVE-2023-7113
Mattermost Cross-site Scripting vulnerability
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
CVE-2023-7113- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-3217
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
EUVD-2023-3217- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3gq-j7p9-x3p4
Mattermost Cross-site Scripting vulnerability
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
GHSA-h3gq-j7p9-x3p4- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
CVE-2023-7113- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
CVE-2023-7113- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-h3gq-j7p9-x3p4
Mattermost Cross-site Scripting vulnerability
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
GHSA-h3gq-j7p9-x3p4- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-mattermost-2023-7113 No score
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
- Record
BIT-mattermost-2023-7113- Updated
- 2026-11-02
OSVGO-2024-2446 No score
Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server
Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.7.
- Record
GO-2024-2446- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go |
before 8.1.7 | 8.1.7 |
mattermostBitnami |
before 8.1.7 | 8.1.7 |
github.com/mattermost/mattermost-serverGo |
All versions | None known |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
github.com/mattermost/mattermost/server/v8Go |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-7113 is a low vulnerability (CVSS 3.7) in Mattermost, published December 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in github.com/mattermost/mattermost/server/v8 8.1.7.