CVE-2021-40525

—

CVSS 3.1

9.1 critical

EPSS

4%p89

Published

Jan 4, 2022 (Jan 4, 2022)

Modified

Jun 17, 2026

Description

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Vendors: apache
Products: james
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (3.7%)

In the news0 stories

No ingested article mentions this CVE yet.