CVE-2026-114425 PUBLISHED

Forged LFT metadata permits arbitrary file read and deletion

Assigner: NCSC.ch
Reserved: 21.10.2026 Published: 04.11.2026 Updated: 04.11.2026

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	SEPPmail AG
Product	SEPPmail Secure Email Gateway (SEG)
Versions	Default: unknown affected from 0 to 15.1.1 (excl.)

Credits

Dario Weiss of InfoGuard Labs finder

References

https://docs.seppmail.com/en/20_revision-history.html

Problem Types

CWE-73 External Control of File Name or Path CWE

Impacts

CAPEC-126 Path Traversal