CVE-2026-108120: path traversal inKoozali - SME Server
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely; no credentials or user interaction are required.
What information could be exposed?
The flaw allows access to files outside the intended system logs directory. This may expose sensitive system and application files.
Which deployment is known to be affected?
The reported affected version is Koozali SME Server 11.0rc1-215. The provided information does not identify other affected or fixed versions.