CVE-2026-8811

Deferred Deferred - Pending Action

Improper File Handling in SEPPmail PDF Generation

Publication date: 2026-06-18

Last updated on: 2026-06-22

Assigner: Switzerland Government Common Vulnerability Program

Description

SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-18

Last Modified

2026-06-22

Generated

2026-07-09

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-08

NVD

CVE-2026-8811

EUVD

EUVD-2026-37866

Affected Vendors & Products

Vendor	Product	Version / Range
seppmail	seppmail_secure_e_mail_gateway	to 15.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Impact Analysis

This vulnerability can allow an attacker to place files in web-accessible locations outside the intended directory.

Such unauthorized file placement could lead to exposure of sensitive information, unauthorized access, or further exploitation of the system.

Executive Summary

SEPPmail versions before 15.0.5 have a vulnerability related to improper handling of attachment filenames during the generation of encrypted PDF files.

An attacker can exploit this flaw to create new files outside the intended directory, which means they could place files in locations that are accessible via the web.

Compliance Impact

The vulnerability in SEPPmail versions before 15.0.5 allows attackers to create files outside the intended directory, potentially placing files in web-accessible locations. This improper handling of attachment filenames during encrypted PDF generation could lead to unauthorized data exposure or manipulation.

Such unauthorized file creation and potential data exposure may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive data to prevent unauthorized access or disclosure.

However, no explicit information is provided in the available context or resources about direct effects or guidance regarding compliance with these standards.

Mitigation Strategies

SEPPmail versions before 15.0.5 are vulnerable due to improper handling of attachment filenames during encrypted PDF generation, which can allow attackers to place files outside intended directories.

To mitigate this vulnerability, upgrade SEPPmail Secure E-Mail Gateway to version 15.0.5 or later where this issue is fixed.

Hi! I’m here to help you understand CVE-2026-8811. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70