CVE-2026-2743

SEPPmail User Web Interface Arbitrary File Write to RCE

State: Published
Severity: 10.0 Critical
Published: Mar 5, 2026
Updated: May 19, 2026
Reserved: Feb 19, 2026

Description

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT).

This issue affects SeppMail: 15.0.2.1 and before

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y	NCSC.ch

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
SeppMailSeppMail	unknown through 15.0.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.