An issue exists in Mattermost Server prior to 5.18.0. It has weak permissions for server-local file storage.
mattermost mattermost server