Domain Creation Vulnerability in Koozali's SME Server Product
CVE-2026-108121

6.9MEDIUM

Key Information:

Vendor

Koozali

Status
Sme Server
Vendor
CVE Published:
19 October 2026

What is CVE-2026-108121?

A vulnerability has been identified in the domain creation functionality of Koozali's SME Server, permitting attackers with elevated privileges to inject reserved directives into Apache's configuration. This malicious action can corrupt the httpd.conf file, leading to a failure in starting Apache after a system reboot. Consequently, this results in a denial-of-service condition that adversely affects the web server and all hosted virtual domains.

Affected Version(s)

SME Server Linux 11.0rc1-215

References

https://digitalcanion.com/en/security-research/#vendor=ko...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Mariani from DigitalCanion SA
.