CVE-2026-114425

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

• CWE-73

• https://docs.seppmail.com/en/20_revision-history.html

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11441A vulnerability was identified in theonedev onedev up to 15.…6.3
• CVE-2026-11442Allegra exportReport Directory Traversal Information Disclos…6.5
• CVE-2026-114420SEPPmail Secure Email Gateway before 15.1.1 does not neutral…6.9
• CVE-2026-114421SEPPmail Secure Email Gateway before 15.1.1 permits password…8.3
• CVE-2026-114422The Enable Media Replace WordPress plugin before 4.2.3 does …7.5
• CVE-2026-114424SEPPmail Secure Email Gateway before 15.1.1 can evaluate att…9.2
• CVE-2026-114426SEPPmail Secure Email Gateway before 15.1.1 processes and wr…8.7
• CVE-2026-114427The GutenKit WordPress plugin before 2.5.5 does not properl…6.8
• CVE-2026-114429The WPVR WordPress plugin before 9.0.3 does not properly sa…6.8
• CVE-2026-11443Allegra downloadAttachment Cross-Site Scripting Authenticati…4.6
• CVE-2026-114431The Enable Media Replace WordPress plugin before 4.2.3 does …6.4
• CVE-2026-114437In the Golang Chi web framework, the ClientIPFromXFF middlew…4.8