Read the docs
TI-2008-06700 Aliases CVE-2008-7012GHSA-35mr-3g6g-qqwc

courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Complete · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters.

Why it matters now

EPSS 0.06674 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:h:accellion:secure_file_transfer_appliance:*:*:*:*:*:*:*:*up to 7_0_178VulnerableAccellion
cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_135:*:*:*:*:*:*:*7_0_135VulnerableAccellion
  • cpe:2.3:h:accellion:secure_file_transfer_appliance:*:*:*:*:*:*:*:* Versions up to 7_0_178 Vulnerable ·Accellion
  • cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_135:*:*:*:*:*:*:* Versions 7_0_135 Vulnerable ·Accellion

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-7012
  2. 2026-10-03 Alias added: GHSA-35mr-3g6g-qqwc

References

Exploit 1

Other 1

  • TI-2009-04400 Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated… CVSS 2.0HIGH 9.0
  • TI-2009-04402 Static code injection vulnerability in the administrative web interface in Accellion… CVSS 2.0HIGH 9.0
  • TI-2009-04401 Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File… CVSS 2.0HIGH 7.8
  • TI-2009-04404 Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access… CVSS 2.0HIGH 7.2
  • TI-2008-03689 Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows… CVSS 2.0MEDIUM 4.3
  • TI-2009-04403 Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences