Read the docs
TI-2026-76243 Aliases CVE-2026-108120GHSA-wj5h-2j88-93vj

Path traversal in Koozali SME Server View Logs exposes files

Priority MEDIUM 40CWE-31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Koozali SME Server from version 11.0rc1-215 is affected. The View Logs functionality has a path traversal flaw (CWE-31) that does not keep file access within the intended logs directory. An unauthenticated remote attacker can read files outside that directory, including potentially sensitive system and application files.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KoozaliSME Server11.0rc1-215—No fix listedCNA
  • SME Server VendorKoozali Affected 11.0rc1-215 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SME Server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-108120
  2. 2026-10-19 Alias added: GHSA-wj5h-2j88-93vj
  3. 2026-10-19 Priority changed: MEDIUM → LOW
  4. 2026-10-20 CISA SSVC decision points changed
  5. 2026-10-20 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-76244 Koozali SME Server domain creation flaw enables denial of service CVSS 4.0MEDIUM 6.9
  • TI-2017-14373 Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences