# CVE-2026-14298

## Summary

- **CVE ID:** CVE-2026-14298
- **Severity:** MEDIUM
- **CVSS Score:** 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-409
- **Published:** Aug 13, 2026
- **Last Modified:** Aug 13, 2026

## Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713

## Affected Products

- Mattermost — Mattermost (11.9.0)
- Mattermost — Mattermost (11.8.0)
- Mattermost — Mattermost (11.7.0)
- Mattermost — Mattermost (10.11.0)
- Mattermost — Mattermost (11.10.0)
- Mattermost — Mattermost (11.9.1)
- Mattermost — Mattermost (11.8.5)
- Mattermost — Mattermost (11.7.8)
- Mattermost — Mattermost (10.11.23)

## References

- [CNA](https://mattermost.com/security-updates)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.24%
- **EPSS Percentile:** 15.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._