Path Traversal Vulnerability in Apache James Server Affects User SIEVE Scripts
CVE-2026-76168

Currently unrated

Key Information:

Vendor

Apache
Status
Apache James
Vendor
CVE Published:
6 November 2026

What is CVE-2026-76168?

A vulnerability exists in Apache James Server prior to version 3.9.1, where improper validation of file paths in the SieveFileRepository can result in path traversal. This flaw allows an authenticated attacker to manipulate file paths, enabling them to set arbitrary SIEVE scripts for other users. Such actions could potentially lead to denial of service or unauthorized traffic interception. To mitigate this issue, users are strongly urged to upgrade to version 3.9.1 or later.

Affected Version(s)

Apache James 0 < 3.9.1

References

https://lists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdk...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k Security
.