In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal…
In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache James
- Fix
- available
- Weakness
- CWE-22
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 25 (Notable)
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-76168 on this site · NVD · CVE.org · Vulnpedia