Live › vulnerability › CVE-2026-108120
Go to dashboardPath traversal in the View Logs panel of the SME Server (Koozali) server-manager lets a remote attacker read files outside the logs directory. The CVE says unauthenticated; the researcher says the web management portal. Affects systems whose server-manager is reachable from untrusted networks; LAN-only managers are at lower risk. No fixed version published yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running koozali SME Server 11.0rc1-215 with the View Logs functionality reachable by a network client. The sources do not name a fixed version. Installations where the management interface is not reachable from untrusted networks are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SME Server | vendor | 11.0rc1-215 (CVE); 11.0.0-267.el8 (researcher) | – |
rpm -q smeserver-manager and cat /etc/e-smith-release11.0.0-267.el8 (researcher), so treat builds not confirmed patched as exposedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.
This page as .md · .json · in your agent: get_signal("CVE-2026-108120")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.