CVE-2026-76168
CRITICAL
INFO
Priority: 0.05
BB Relevance:
80/100
Published: 2026-11-06
Modified: 2026-11-10
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache James | 0 < 3.9.1 |
| Apache Software Foundation | Apache James | 0 < 3.9.1 |
| Apache Software Foundation | Apache James | 0 < 3.9.1 |
References & Advisories (2)
vendor-advisory