Path Traversal Vulnerability in Koozali's SME Server
CVE-2026-108120

7.7HIGH

Key Information:

Vendor

Koozali

Status
Sme Server
Vendor
CVE Published:
19 October 2026

What is CVE-2026-108120?

A path traversal vulnerability has been identified in the View Logs feature of Koozali's SME Server, specifically in version 11.0rc1-215. This vulnerability allows unauthenticated attackers to manipulate file paths, enabling them to access files outside the designated directory. Such unauthorized access raises significant security concerns, as it could lead to the exfiltration of sensitive system and application files that are critical for maintaining the integrity and confidentiality of the system.

Affected Version(s)

SME Server Linux 11.0rc1-215

References

https://digitalcanion.com/en/security-research/#vendor=ko...

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Mariani from DigitalCanion SA
.