CVE-2026-44127: Local File Inclusion (LFI) and Arbitrary File Deletion
SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44127?
CVE-2026-44127 has been classified as a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2026-44127?
To fix CVE-2026-44127, upgrade SEPPmail Secure Email Gateway to version 15.0.4 or later.
What kind of attacks can CVE-2026-44127 facilitate?
CVE-2026-44127 can facilitate local file inclusion attacks and allow unauthorized file deletion.
Is CVE-2026-44127 exploitable without authentication?
Yes, CVE-2026-44127 can be exploited without authentication, enabling remote attackers to access local files.
What is affected by CVE-2026-44127?
CVE-2026-44127 affects SEPPmail Secure Email Gateway versions prior to 15.0.4.