Apache James ManageSieve path traversal vulnerability
Apache James before 3.9.1 allows cross-user path traversal in ManageSieve file implementation, enabling arbitrary SIEVE scripts.
50
CVE-2026-76168
Path traversal in Apache James SieveFileRepository before 3.9.1
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache James server prior to 3.9.1 has incorrect validation of file paths in SieveFileRepository allowing path traversal. A logged-in attacker can set arbitrary SIEVE scripts for other users, causing denial of service or traffic capture. Affects all users of affected Apache James versions.
What to do: Upgrade to Apache James 3.9.1. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache James | prior to 3.9.1 | 3.9.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H