{"id":"CVE-2026-108120","kind":"vulnerability","aliases":["CVE-2026-108120"],"related":[],"title":"SME Server: path traversal in View Logs leaks files unauthenticated","description":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system logs \ndirectory, including potentially sensitive system and application files.","summary":"Path traversal in the View Logs panel of the SME Server (Koozali) server-manager lets a remote attacker read files outside the logs directory. The CVE says unauthenticated; the researcher says the web management portal. Affects systems whose server-manager is reachable from untrusted networks; LAN-only managers are at lower risk. No fixed version published yet.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SME Server","fixed":[],"affected":"11.0rc1-215 (CVE); 11.0.0-267.el8 (researcher)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","koozali","linux","path-traversal","self-hosted","sme-server"],"not_affected_if":["auth-required","manager-not-exposed","patched-sme-update"],"how_to_check":"Run 'rpm -q smeserver-manager' and 'cat /etc/e-smith-release'. Reported affected builds: 11.0rc1-215 (CVE), 11.0.0-267.el8 (researcher), so treat builds not confirmed patched as exposed. Check whether the server-manager View Logs page is reachable from untrusted networks.","fix":"unknown: apply the latest SME Server 11 updates (dnf update). No fixed smeserver-manager version is published; check bugs.koozali.org or the smeserver-manager changelog.","status":"open","published_at":"2026-10-19T06:17:21+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:10:54+00:00","updated_at":"2026-10-25T03:43:42+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-10-25T03:10:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SME Server: path traversal in View Logs leaks files unauthenticated","impact":"high","summary":"The View Logs feature in koozali SME Server 11.0rc1-215 fails to confine file paths to the logs directory. An unauthenticated attacker can read files outside that directory, including system and application files.","category":"infrastructure","nicknames":[],"who_cares":["sme-server","self-hosted","linux"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads sensitive system and application files without logging in","analyst_note":"Find the fixed SME Server version and the advisory from koozali or NVD, and confirm whether View Logs is exposed by default.","how_to_check":"- Check the installed SME Server version and whether it is `11.0rc1-215`\n- Confirm whether the View Logs page is reachable from the network","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Sites running koozali SME Server 11.0rc1-215 with the View Logs functionality reachable by a network client. The sources do not name a fixed version. Installations where the management interface is not reachable from untrusted networks are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000562,"input_tokens":3349,"output_tokens":454,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed SME Server version and the advisory from koozali or NVD, and confirm whether View Logs is exposed by default.","search":"'-108120':13A,16A '-2026':12A,15A '-215':115C '11.0':113C 'access':121C 'affect':67B 'allow':116C 'applic':145C 'attack':49B,119C 'brian':91C 'cve':11A,14A,57B 'digitalcanion':94C 'directori':55B,127C,139C 'discov':97C 'exfiltr':130C 'file':9A,51B,122C,132C,146C 'fix':87B 'function':106C 'host':27B 'includ':140C 'infrastructur':19B 'intend':126C,136C 'koozali':20B,42B,108C 'lan':79B 'lan-on':78B 'lead':128C 'leak':8A 'let':46B 'linux':21B 'locat':133C 'log':7A,36B,54B,105C,138C 'lower':84B 'manag':45B,65B,72B,81B 'mariani':92C 'network':77B 'outsid':52B,123C,134C 'panel':37B 'path':3A,23B,31B,99C 'path-travers':22B 'portal':66B 'potenti':141C 'publish':89B 'rc1':114C 'reachabl':74B 'read':50B 'remot':48B 'research':61B 'risk':85B 'sa':95C 'say':58B,62B 'self':26B 'self-host':25B 'sensit':142C 'server':2A,18A,30B,41B,44B,71B,111C 'server-manag':43B,70B 'sme':1A,17A,29B,40B,110C 'sme-serv':28B 'system':68B,137C,143C 'travers':4A,24B,32B,100C 'unauthent':10A,59B,118C 'untrust':76B 'version':88B,112C 'view':6A,35B,104C 'vulner':101C 'web':64B 'whose':69B 'yet':90B","nicknames":[],"mitigations":[],"who_affected":"Sites running koozali SME Server 11.0rc1-215 with the View Logs functionality reachable by a network client. The sources do not name a fixed version. Installations where the management interface is not reachable from untrusted networks are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108120","severity":null,"published_at":"2026-10-19T06:17:21+00:00","modified_at":"2026-10-19T21:03:42+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108120:779","url":null,"severity":null,"published_at":"2026-10-25T03:43:42+00:00","modified_at":"2026-10-25T03:43:42+00:00","first_seen_at":"2026-10-25T03:43:42+00:00","fetched_at":"2026-10-25T03:43:42+00:00","note":"No koozali advisory or fixed version found. CVE record (Swiss NCSC CNA) says 11.0rc1-215 affected, CVSS4 7.7; researcher DigitalCanion page says 11.0.0-267.el8 affected and 'update to latest SME update' (version conflict, fix unknown). Feedly flags Patched but gives no source. No PoC or exploitation found. Nothing marked verified."}],"documents":[{"id":3308,"url":"https://www.cve.org/cverecord?id=CVE-2026-108120","title":"CVE record CVE-2026-108120","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3309,"url":"https://digitalcanion.com/en/security-research/#vendor=koozali","title":"DigitalCanion: Koozali SME Server View Logs path traversal (DGI-SWISS-00036)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}