What’s Vulnerable › Vulnerabilities
CVE-2022-2406: Malicious imports can lead to Denial of Service
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-07-14 · updated 2026-06-17
- Weakness: CWE-400
Description
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
Affected products
- Mattermost App Framework: through 6.3.8; from 6.4.0 through 6.5.1; 6.6.0, 6.6.1, 6.7.0
References
Get alerted when CVE-2022-2406 or the next vulnerability affects your stack