by Kastro
Paper/Archive/CVE-2026-76168

CVE-2026-76168

Apache Software Foundation Apache James — Apache James: ManageSieve file implementation cross-user path traversal

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 14.3.143 × 202.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache James< 3.9.13.9.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdko9oh3qrmdnk2refopenwall.com/lists/oss-security/2026/11/06/16