CVE-2026-76168 · Package
NO FIX YET · SEE WHAT TO DO
Apache James server versions before 3.9.1 fail to validate file paths in SieveFileRepository, enabling path traversal. A logged-in attacker can write arbitrary Sieve mail scripts for other users, which can cause denial of service or capture their mail traffic.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Operators running Apache James server before 3.9.1 that use the SieveFileRepository for mail filtering. The attacker needs a logged-in account on the server. Deployments on version 3.9.1 or later are not affected.
Not affected if sieve-not-used, version-3.9.1-or-later
Who cares apache-james, mail-server, self-hosted
3.9.1.3.9.1.In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.