CVE-2026-114425 Details
Description
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
A vulnerability exists in SEPPmail Secure Email Gateway versions prior to 15.1.1, where the application improperly validates file paths in Large File Transfer (LFT) attachment metadata. This flaw enables an unauthenticated remote sender to manipulate the mail-processing worker into disclosing, moving, or deleting accessible regular files. The issue arises when LFT is activated and the message is processed through an affected secure-mail pathway, with the mail-processing worker running as root.
Users can update to SEPPmail Secure Email Gateway version 15.1.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.seppmail.com/en/20_revision-history.html | [email protected] | AdvisoryBundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SEPPmail Secure Email Gateway | < 15.1.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |