---
id: "CVE-2026-108120"
kind: "vulnerability"
aliases: ["CVE-2026-108120"]
title: "SME Server: path traversal in View Logs leaks files unauthenticated"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SME Server", "fixed": [], "affected": "11.0rc1-215 (CVE); 11.0.0-267.el8 (researcher)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "koozali", "linux", "path-traversal", "self-hosted", "sme-server"]
not_affected_if: ["auth-required", "manager-not-exposed", "patched-sme-update"]
published_at: "2026-10-19T06:17:21+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:43:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108120", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:43:42+00:00"}]
---

# SME Server: path traversal in View Logs leaks files unauthenticated

Path traversal in the View Logs panel of the SME Server (Koozali) server-manager lets a remote attacker read files outside the logs directory. The CVE says unauthenticated; the researcher says the web management portal. Affects systems whose server-manager is reachable from untrusted networks; LAN-only managers are at lower risk. No fixed version published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SME Server affected 11.0rc1-215 (CVE); 11.0.0-267.el8 (researcher) fixed ?

## How to check

Run 'rpm -q smeserver-manager' and 'cat /etc/e-smith-release'. Reported affected builds: 11.0rc1-215 (CVE), 11.0.0-267.el8 (researcher), so treat builds not confirmed patched as exposed. Check whether the server-manager View Logs page is reachable from untrusted networks.

## Fix

unknown: apply the latest SME Server 11 updates (dnf update). No fixed smeserver-manager version is published; check bugs.koozali.org or the smeserver-manager changelog.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108120
- 2026-10-25T03:43:42+00:00 analyst — No koozali advisory or fixed version found. CVE record (Swiss NCSC CNA) says 11.0rc1-215 affected, CVSS4 7.7; researcher DigitalCanion page says 11.0.0-267.el8 affected and 'update to latest SME update' (version conflict, fix unknown). Feedly flags Patched but gives no source. No PoC or exploitation found. Nothing marked verified.

## Documents

- [advisory] CVE record CVE-2026-108120 https://www.cve.org/cverecord?id=CVE-2026-108120
- [describes] DigitalCanion: Koozali SME Server View Logs path traversal (DGI-SWISS-00036) https://digitalcanion.com/en/security-research/#vendor=koozali

## From the sources

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of 
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated 
attacker to access files outside of the intended directory, leading to 
exfiltration of files located outside the intended system logs 
directory, including potentially sensitive system and application files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_