CVE-2026-8811
Path traversal in PDF generation module
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 18, 2026
- Updated
- Jun 18, 2026
- Reserved
- May 18, 2026
Description
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L | NCSC.ch |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Secure Email GatewaySEPPmail AG |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.