CVE-2026-114425: Forged LFT metadata permits arbitrary file read and deletion
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SEPPmail Secure Email Gatewayto a version that resolves this vulnerability.Fixed in 15.1.1
Event History
Frequently Asked Questions
Which deployments are exposed?
SEPPmail Secure Email Gateway deployments before 15.1.1 are exposed when Large File Transfer (LFT) is enabled and externally supplied messages reach an affected secure-mail processing path. The issue affects files accessible to the mail-processing worker.
Does exploitation require an account or user interaction?
No. An unauthenticated remote sender can exploit the issue by supplying forged file-path metadata in an LFT attachment, provided the message reaches the affected processing path.
What is the potential impact on an affected gateway?
The mail-processing worker can be caused to disclose, move, or delete an accessible regular file. The validated workers ran as root, which can make the accessible file set highly sensitive.
What can be done if upgrading is not immediately possible?
Disable LFT or prevent externally supplied messages from reaching the affected secure-mail processing path. This follows from the stated exploitation conditions, though the provided data does not specify a vendor-supported mitigation procedure.