CVE-2026-76168: Apache James: ManageSieve file implementation cross-user path traversal

Published Nov 6, 2026

Updated

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache James Server to a version that resolves this vulnerability.
Fixed in 3.9.1

Event History

Nov 6, 2026

CVE Published

via MITRE·11:44 AM

Data Sourced

via MITRE·11:44 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache James server deployments prior to 3.9.1 that rely on the SieveFileRepository are affected.

What does an attacker need to exploit it?

The attacker must be logged in. They can abuse insufficient file-path validation to set SIEVE scripts for other users.

What is the potential impact?

An attacker can install arbitrary SIEVE scripts for other users, which can cause denial of service or potentially capture mail traffic.

What is the recommended remediation?

Upgrade Apache James to version 3.9.1, which fixes the issue.

CVE-2026-76168: Apache James: ManageSieve file implementation cross-user path traversal

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact?

What is the recommended remediation?