CVE-2026-114425: Forged LFT metadata permits arbitrary file read and deletion

Analysis on rafaelpfister.ch

Article · November 3, 2026 SEPPmail 15.1.1: Five CVE Fixes and a Fix for the DNS Regression from 15.1.0.1 SEPPmail 15.1.1 closes five vulnerabilities with CVSS scores of up to 9.2, including code execution through address replacement rules and file access through Large File Transfer. The patch release also fixes a DNS regression from 15.1.0.1 and should be installed promptly.

Vendor description

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

Reference data

Vendor

SEPPmail AG

Affected products

SEPPmail Secure Email Gateway (SEG)

CVSS 4.0

9.2 (CRITICAL)

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weakness type

CWE-73: External Control of File Name or Path

Published

November 4, 2026

Official sources

← All vulnerabilities

CVE-2026-114425 Forged LFT metadata permits arbitrary file read and deletion

Analysis on rafaelpfister.ch

Vendor description

Reference data

Official sources

Subscribe