CVE-2026-114425
Received Received - Intake

SEPPmail Secure Email Gateway Path Traversal Vulnerability

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Switzerland Government Common Vulnerability Program

Description
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-114425
EUVD
EUVD-2026-116782

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SEPPmail AG SEPPmail Secure Email Gateway (SEG) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
AI Quick Actions have not been generated yet.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...