{"id":"CVE-2026-114425","kind":"vulnerability","aliases":["CVE-2026-114425"],"related":[],"title":"SEPPmail gateway: unauthenticated mail can disclose, move or delete files","description":"SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.","summary":"SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in Large File Transfer attachment metadata. An unauthenticated remote sender can make the mail-processing worker disclose, move or delete an accessible regular file, and the validated workers ran as root.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","infrastructure","self-hosted","seppmail"],"not_affected_if":["lft-disabled","version-15.1.1-or-later"],"how_to_check":"- Check the installed SEPPmail version against the fixed release in the product ranges.\n- Check whether Large File Transfer (LFT) is enabled on the gateway; the flaw needs it enabled.","fix":"- SEPPmail Secure Email Gateway: move to `15.1.1` or later.","status":"open","published_at":"2026-11-04T09:17:41+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","triaged_at":"2026-11-04T09:26:47+00:00","updated_at":"2026-11-04T09:26:47+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T09:26:47Z","model":"claude-haiku-5-5","output":{"fix":"- SEPPmail Secure Email Gateway: move to `15.1.1` or later.","reach":"internet","title":"SEPPmail gateway: unauthenticated mail can disclose, move or delete files","impact":"high","summary":"SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in Large File Transfer attachment metadata. An unauthenticated remote sender can make the mail-processing worker disclose, move or delete an accessible regular file, and the validated workers ran as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["seppmail","email-gateway","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated sender reads, moves or deletes files as root","analyst_note":"Confirm the fixed version and any LFT-disabled mitigation from the NVD entry or vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-114425.","how_to_check":"- Check the installed SEPPmail version against the fixed release in the product ranges.\n- Check whether Large File Transfer (LFT) is enabled on the gateway; the flaw needs it enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["lft-disabled","version-15.1.1-or-later"],"who_is_affected":"Organisations running SEPPmail Secure Email Gateway before 15.1.1 with Large File Transfer enabled, since inbound mail reaches the vulnerable path. Gateways without LFT enabled, or already on 15.1.1 or later, are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000722,"input_tokens":4159,"output_tokens":613,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114425':13A,16A '-2026':12A,15A '15.1.1':30B,73C 'access':58B,104C 'affect':116C 'attach':40B,85C 'caus':92C 'cve':11A,14A 'delet':9A,56B,102C 'disclos':6A,53B,99C 'email':18B,27B,70C 'email-gateway':17B 'enabl':110C 'extern':80C 'file':10A,33B,38B,60B,76C,83C,106C 'gateway':2A,19B,28B,71C 'host':23B 'infrastructur':20B 'larg':37B,82C 'lft':108C 'mail':4A,50B,95C,119C 'mail-process':49B,94C 'make':47B 'messag':113C 'metadata':41B,86C 'move':7A,54B,100C 'path':34B,77C,121C 'process':51B,96C,120C 'provid':81C 'ran':65B,125C 'reach':114C 'regular':59B,105C 'remot':44B,89C 'root':67B,127C 'secur':26B,69C,118C 'secure-mail':117C 'self':22B 'self-host':21B 'sender':45B,90C 'seppmail':1A,24B,25B,68C 'suppli':35B,78C 'transfer':39B,84C 'trust':31B,74C 'unauthent':3A,43B,88C 'valid':63B,123C 'worker':52B,64B,97C,124C","nicknames":[],"mitigations":[],"who_affected":"Organisations running SEPPmail Secure Email Gateway before 15.1.1 with Large File Transfer enabled, since inbound mail reaches the vulnerable path. Gateways without LFT enabled, or already on 15.1.1 or later, are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","emailgateway","infrastructure","selfhosted","seppmail"],"campaign_type":null,"first_public_at":"2026-11-04T09:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114425","severity":null,"published_at":"2026-11-04T09:17:41+00:00","modified_at":"2026-11-04T09:17:41+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","fetched_at":"2026-11-04T09:26:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}