TI-2026-02349 CVE-2026-2743 · GHSA-3hq3-ff7h-6mf5
SEPPmail User Web Interface Arbitrary File Write to RCE
Priority HIGH 82
Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface.
SEPPmail
Records42All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9
Exploited now
SEPPmail records in CISA KEVNo SEPPmail vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Seppmail · all components
TI-2021-11768 CVE-2021-31740 · GHSA-v7pm-56h6-94x6
SEPPMail's web frontend, user input is not embedded correctly in the web page and…
Priority MEDIUM 60
SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS).
TI-2021-11767 CVE-2021-31739 · GHSA-5q2f-65mc-6jvf
The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS)…
Priority MEDIUM 60
The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient ad…
TI-2026-21852 CVE-2026-27441 · GHSA-f2gg-j592-6p52
PDF Password CMDi
Priority MEDIUM 49
SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.
TI-2026-21853 CVE-2026-27442 · GHSA-rm39-837c-v934
zip_attachments Path Traversal
Priority MEDIUM 42
The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.
TI-2026-21854 CVE-2026-27443 · GHSA-5v5x-g684-qwfj
S/MIME Decryption Tag Sanitization Bypass
Priority MEDIUM 41
SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.
TI-2026-21855 CVE-2026-27444 · GHSA-5wwg-q432-32vv
Header Email Address Parsing
Priority MEDIUM 40
SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the sourc…
TI-2022-20213 CVE-2022-41871 · GHSA-9mh9-7p8c-gr7g
OS command injection in SEPPmail
Priority MEDIUM 40
SEPPmail through 12.1.17 allows command injection within the Admin Portal.
TI-2026-02353 CVE-2026-2748 · GHSA-qg5v-hxpj-p53x
S/MIME Certificate Subject Whitespace
Priority LOW 39
SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allowing signature spoofing.
TI-2026-02351 CVE-2026-2746 · GHSA-27h3-67h6-73p2
Missing PGP Signature Tag
Priority LOW 36
SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, leaving users unable to detect forged emails.
TI-2026-02352 CVE-2026-2747 · GHSA-xqvf-f6fr-95j7
PGP Mixed Plaintext and Encrypted Content
Priority LOW 30
SEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowing exposure of sensitive information to an unauthorized actor.
TI-2026-21856 CVE-2026-27445 · GHSA-c9q4-c3c7-wxx7
PGP Signature Reflection
Priority LOW 29
SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the expected key, allowing signature spoofing.