CVE-2026-2743
9.8 CRITICALArbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface
Published: 2026-03-05 · Last updated: 2026-05-19
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-22, CWE-434
Affected products
| Vendor | Product |
|---|---|
| seppmail | seppmail |
Description
Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-2743
- [Other]https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html
- [Other]https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
- [Other]https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
Related CVEs
Same CWE
- CVE-2026-12089 — The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, an... (4.9 MEDIUM)
- CVE-2026-11442 — Allegra exportReport Directory Traversal Information Disclosure Vulnerability (6.5 MEDIUM)
- CVE-2026-53825 — OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gatewa... (6.5 MEDIUM)
- CVE-2026-53519 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (9.1 CRITICAL)
- CVE-2026-54394 — MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo