CVE-2026-114424

SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.

• CWE-95

• https://docs.seppmail.com/en/20_revision-history.html

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114409Docker Desktop before version 4.97.0 could write third-party…5.7
• CVE-2026-11441A vulnerability was identified in theonedev onedev up to 15.…6.3
• CVE-2026-11442Allegra exportReport Directory Traversal Information Disclos…6.5
• CVE-2026-114420SEPPmail Secure Email Gateway before 15.1.1 does not neutral…6.9
• CVE-2026-114421SEPPmail Secure Email Gateway before 15.1.1 permits password…8.3
• CVE-2026-114422The Enable Media Replace WordPress plugin before 4.2.3 does …7.5
• CVE-2026-114425SEPPmail Secure Email Gateway before 15.1.1 trusts a file pa…9.2
• CVE-2026-114426SEPPmail Secure Email Gateway before 15.1.1 processes and wr…8.7
• CVE-2026-114427The GutenKit WordPress plugin before 2.5.5 does not properl…6.8
• CVE-2026-114429The WPVR WordPress plugin before 9.0.3 does not properly sa…6.8
• CVE-2026-11443Allegra downloadAttachment Cross-Site Scripting Authenticati…4.6
• CVE-2026-114431The Enable Media Replace WordPress plugin before 4.2.3 does …6.4