Apache James ManageSieve path traversal vulnerability
Original title: CVE-2026-76168: Apache James: ManageSieve file implementation cross-user path traversal
Apache James before 3.9.1 allows cross-user path traversal in ManageSieve file implementation, enabling arbitrary SIEVE scripts.
The flaw relies on insufficient validation of file paths in the SieveFileRepository. A logged-in attacker can set arbitrary SIEVE scripts for other users, resulting in denial of service or traffic capture.
- Affects Apache James before 3.9.1
- Allows arbitrary SIEVE scripts for other users
- Potential DoS or traffic capture
Impact: arbitrary SIEVE script execution for other users
- 1.upgrade to 3.9.1 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76168 | Path traversal in Apache James SieveFileRepository before 3.9.1 | 9.8 | — |
From the original article
Posted by Benoit Tellier on Nov 06 Severity: important Affected versions: - Apache James before 3. 9. 1 Description: In Apache James server prior version 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.