Vulnerabilities CVE-2026-44127

CVE-2026-44127

High

Open

TLP:CLEAR

Local File Inclusion (LFI) and Arbitrary File Deletion

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.

Details

CVSS Score: 8.8
EPSS Score ⓘ: 15.65%

96.6th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Confidence: 90%
Published: May 8, 2026
Last Modified: May 8, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.