File Path Manipulation Vulnerability in SEPPmail Secure Email Gateway
CVE-2026-114425

9.2CRITICAL

Key Information:

Vendor

Seppmail Ag

Status
Seppmail Secure Email Gateway (seg)
Vendor
CVE Published:
4 November 2026

What is CVE-2026-114425?

The SEPPmail Secure Email Gateway prior to version 15.1.1 contains a vulnerability that allows unauthenticated remote senders to manipulate file paths in Large File Transfer attachment metadata. This weakness enables the mail-processing worker to inadvertently disclose, relocate, or delete sensitive regular files when LFT is activated, compromising system integrity, especially since the validated worker operates with root privileges.

Affected Version(s)

SEPPmail Secure Email Gateway (SEG) 0 < 15.1.1

References

https://docs.seppmail.com/en/20_revision-history.html

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario Weiss of InfoGuard Labs
.