Read the docs
TI-2020-05875 Aliases CVE-2020-7268GHSA-qwh9-c7jr-5v9g

McAfee Email Gateway (MEG) - Path Traversal vulnerability

Priority LOW 22CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Path Traversal vulnerability in McAfee McAfee Email Gateway (MEG) prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory.

Why it matters now

EPSS 0.00979 62nd percentileScored 2026-11-07
Fix Fixed McAfee Email Gateway (MEG) (McAfee): 7.6.406

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Email Gateway (MEG)before 7.6.4067.6.406Patch availableCNA
  • McAfee Email Gateway (MEG) VendorMcAfee Affected before 7.6.406 Fixed in 7.6.406 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:email_gateway:*:*:*:*:*:*:*:*before 7.6.406VulnerableMcAfee
  • cpe:2.3:a:mcafee:email_gateway:*:*:*:*:*:*:*:* Versions before 7.6.406 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Email Gateway (MEG) (McAfee) Fixed in 7.6.406

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7268
  2. 2026-10-03 Alias added: GHSA-qwh9-c7jr-5v9g

References

Other 1

  • TI-2013-05836 McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary… CVSS 2.0HIGH 9.0
  • TI-2013-05835 McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary… CVSS 2.0HIGH 9.0
  • TI-2013-05317 McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote… CVSS 2.0HIGH 8.5
  • TI-2012-03935 McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and… CVSS 2.0HIGH 7.5
  • TI-2009-01282 The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security… CVSS 2.0HIGH 7.6
  • TI-2010-02028 The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote… CVSS 2.0MEDIUM 6.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences