Mattermost Server Version

11.10.2

Operating System

Ubuntu 26.04 (and probably any other Unix-like OS)

Steps to reproduce

1. wget https://releases.mattermost.com/11.11.0/mattermost-11.11.0-linux-amd64.tar.gz # current latest
2. tar tvf mattermost-11.11.0-linux-amd64.tar.gz | head

Expected behavior

drwxrwxr-x root/root         0 2026-09-11 08:52 mattermost/
drwxrwxr-x root/root         0 2026-09-11 08:52 mattermost/prepackaged_plugins/
-rw-rw-r-- root/root  32570767 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz
-rw-rw-r-- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz.sig
-rw-rw-r-- root/root  15900090 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz
-rw-rw-r-- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz.sig
-rw-rw-r-- root/root  16578584 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz
-rw-rw-r-- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz.sig
-rw-rw-r-- root/root   9828026 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz
-rw-rw-r-- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz.sig

Observed behavior

drwxrwxrwx root/root         0 2026-09-11 08:52 mattermost/
drwxrwxrwx root/root         0 2026-09-11 08:52 mattermost/prepackaged_plugins/
-rw-rw-rw- root/root  32570767 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz
-rw-rw-rw- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz.sig
-rw-rw-rw- root/root  15900090 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz
-rw-rw-rw- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz.sig
-rw-rw-rw- root/root  16578584 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz
-rw-rw-rw- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz.sig
-rw-rw-rw- root/root   9828026 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz
-rw-rw-rw- root/root       566 2026-09-11 08:52 mattermost/prepackaged_plugins/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz.sig

Additional Information

The installation instructions suggest extracting the files as non-root, which will result in the user’s umask being applied to the output files, so that’ll cause the world-writablity bit to get dropped (hopefully for most users).

It’d still be better though if the files were 0660/0770 (or at least 0664/0775) even when extracted as root. (Group-writability is enforced by the instructions’ sudo chmod -R g+w /opt/mattermost in any case.)