Unauthenticated Path Traversal Vulnerability in SEPPmail Secure Email Gateway
CVE-2026-44127

8.8HIGH

Key Information:

Vendor: Seppmail Ag
Status: Secure Email Gateway
Vendor: CVE Published:; 8 May 2026

🔔 Create Seppmail Ag Vulnerability Alert

What is CVE-2026-44127?

The SEPPmail Secure Email Gateway before version 15.0.4 is impacted by an unauthenticated path traversal vulnerability. This flaw allows remote attackers to exploit the identifier parameter in /api.app/attachment/preview. By doing so, they can access and read arbitrary local files on the server. Additionally, this vulnerability can lead to the deletion of files within the targeted directory, executing operations with the privileges of the api.app process.

Affected Version(s)

Secure Email Gateway 0 < 15.0.4

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.ht...

https://labs.infoguard.ch/posts/seppmail_secure_e-mail_ga...

CVSS V4

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 8, 2026
Vulnerability Reserved
May 5, 2026

CVE-2026-44127 Data

JSON