https://seclists.org/oss-sec/2026/q4/550: CVE-2026-76168: Apache James: ManageSieve file implementation cross-user path traversal
Published Nov 6, 2026
·Updated
Affected Software
1 affected component
Apache James<3.9.1
An attacker must be logged in to an affected Apache James server and able to interact with the SieveFileRepository-backed ManageSieve functionality. The issue allows that attacker to set SIEVE scripts for other users.
An attacker can install arbitrary SIEVE scripts for other users through path traversal. The stated impacts include denial of service and potential traffic capture.
Apache James versions before 3.9.1 are affected when they rely on the SieveFileRepository. The provided information does not establish that installations using other repository implementations are affected.
Upgrade Apache James to version 3.9.1, which fixes the path-validation issue.