{"id":"CVE-2026-76168","kind":"vulnerability","aliases":["CVE-2026-76168"],"related":[],"title":"Apache James: path traversal lets a user set Sieve scripts for others","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","summary":"Apache James server versions before 3.9.1 fail to validate file paths in SieveFileRepository, enabling path traversal. A logged-in attacker can write arbitrary Sieve mail scripts for other users, which can cause denial of service or capture their mail traffic.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-james","mail-server","package","self-hosted"],"not_affected_if":["sieve-not-used","version-3.9.1-or-later"],"how_to_check":"- Check the installed Apache James server version and confirm whether it is below `3.9.1`.\n- Confirm whether the SieveFileRepository (ManageSieve) feature is in use.","fix":"- Apache James server: upgrade to `3.9.1`.","status":"open","published_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:42:57+00:00","updated_at":"2026-11-06T12:42:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T12:42:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apache James server: upgrade to `3.9.1`.","reach":"network","title":"Apache James: path traversal lets a user set Sieve scripts for others","impact":"medium","summary":"Apache James server versions before 3.9.1 fail to validate file paths in SieveFileRepository, enabling path traversal. A logged-in attacker can write arbitrary Sieve mail scripts for other users, which can cause denial of service or capture their mail traffic.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-james","mail-server","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker alters other users' mail filtering scripts, causing denial of service or traffic capture","analyst_note":"","how_to_check":"- Check the installed Apache James server version and confirm whether it is below `3.9.1`.\n- Confirm whether the SieveFileRepository (ManageSieve) feature is in use.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.9.1-or-later","sieve-not-used"],"who_is_affected":"Operators running Apache James server before 3.9.1 that use the SieveFileRepository for mail filtering. The attacker needs a logged-in account on the server. Deployments on version 3.9.1 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4262,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76168':15A,18A '3.9.1':34B,76C,130C 'allow':91C,101C 'apach':1A,20B,29B,71C 'apache-jam':19B 'arbitrari':52B,94C,108C 'attack':49B,105C 'captur':66B,122C 'caus':61B 'cve':13A,16A 'denial':62B,116C 'enabl':42B 'even':120C 'fail':35B 'file':38B,84C 'fix':132C 'host':28B 'incorect':81C 'issu':134C 'jame':2A,21B,30B,72C 'let':5A 'log':47B,103C 'logged-in':46B 'mail':23B,54B,68B 'mail-serv':22B 'other':12A 'packag':25B 'path':3A,39B,43B,85C,89C 'prior':74C 'recommend':125C 'reli':77C 'result':87C,114C 'script':10A,55B,96C,110C 'self':27B 'self-host':26B 'server':24B,31B,73C 'servic':64B,118C 'set':8A,93C,107C 'siev':9A,53B,95C,109C 'sievefilerepositori':41B,80C 'traffic':69B,121C 'transvers':90C 'travers':4A,44B 'upgrad':127C 'user':7A,58B,99C,113C,123C 'valid':37B,82C 'version':32B,75C,129C 'write':51B","nicknames":[],"mitigations":[],"who_affected":"Operators running Apache James server before 3.9.1 that use the SieveFileRepository for mail filtering. The attacker needs a logged-in account on the server. Deployments on version 3.9.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejames","mailserver","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-76168':15A,18A 'apach':1A 'cve':13A,16A 'jame':2A 'let':5A 'other':12A 'path':3A 'script':10A 'set':8A 'siev':9A 'travers':4A 'user':7A","search_b":"'3.9.1':34B 'apach':20B,29B 'apache-jam':19B 'arbitrari':52B 'attack':49B 'captur':66B 'caus':61B 'denial':62B 'enabl':42B 'fail':35B 'file':38B 'host':28B 'jame':21B,30B 'log':47B 'logged-in':46B 'mail':23B,54B,68B 'mail-serv':22B 'packag':25B 'path':39B,43B 'script':55B 'self':27B 'self-host':26B 'server':24B,31B 'servic':64B 'siev':53B 'sievefilerepositori':41B 'traffic':69B 'travers':44B 'user':58B 'valid':37B 'version':32B 'write':51B","search_c":"'3.9.1':76C,130C 'allow':91C,101C 'apach':71C 'arbitrari':94C,108C 'attack':105C 'captur':122C 'denial':116C 'even':120C 'file':84C 'fix':132C 'incorect':81C 'issu':134C 'jame':72C 'log':103C 'path':85C,89C 'prior':74C 'recommend':125C 'reli':77C 'result':87C,114C 'script':96C,110C 'server':73C 'servic':118C 'set':93C,107C 'siev':95C,109C 'sievefilerepositori':80C 'traffic':121C 'transvers':90C 'upgrad':127C 'user':99C,113C,123C 'valid':82C 'version':75C,129C","first_public_at":"2026-11-06T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76168","severity":null,"published_at":"2026-11-06T12:17:21+00:00","modified_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}