Mattermost security updates 7.10.4 / 7.9.6 / 7.8.8 (ESR) released

We’re informing you about a Mattermost security update, which addresses medium-level severity vulnerabilities. We highly recommend that you apply the update.

The security update is available for Mattermost dot releases 7.10.4, 7.9.6 and 7.8.8 (Extended Support Release), for both Team Edition and Enterprise Edition. They are available for download here.

Customer safety and data security are the utmost priorities for Mattermost. For our customers’ protection, and as outlined in our Responsible Disclosure policy, Mattermost does not disclose specifics on this vulnerability until 30 days after this announcement. After 30 days, we will publish specific details on the vulnerability on our Security Updates webpage.

The 7.10.4 and 7.9.6 versions also resolve the following bugs:

• Fixed an issue where posts were not fully sanitized for audit output when a link preview was included.
• Updated prepackaged Playbooks plugin version to 1.36.2.

The 7.8.8 version also resolves the following bugs:

• Fixed an issue where posts were not fully sanitized for audit output when a link preview was included.
• Updated prepackaged Playbooks plugin version to 1.36.2.
• New feature flag DataRetentionConcurrencyEnabled was added to enable/disable concurrency for data retention batch deletion. New config setting DataRetentionSettings.TimeBetweenBatchesMilliseconds was added to control the sleep time between batch deletions.

You can follow the standard upgrade instructions to apply the updates.