CVE-2026-44127

8.8 highEPSS 15%

High (8.8). EPSS 15% chance of exploitation in the next 30 days.

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS: 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-73
Published: 2026-05-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/

Check your stack JSON