---
id: "CVE-2026-76168"
page: "https://infrastack.ai/live/CVE-2026-76168"
kind: "vulnerability"
aliases: ["CVE-2026-76168"]
title: "Apache James: path traversal lets a user set Sieve scripts for others"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-james", "mail-server", "package", "self-hosted"]
not_affected_if: ["sieve-not-used", "version-3.9.1-or-later"]
published_at: "2026-11-06T12:17:21+00:00"
first_seen_at: "2026-11-06T12:41:49+00:00"
updated_at: "2026-11-06T12:42:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76168", "first_seen_at": "2026-11-06T12:41:49+00:00"}]
exploit_sources: []
---

# Apache James: path traversal lets a user set Sieve scripts for others

Link for people: https://infrastack.ai/live/CVE-2026-76168 (this .md is for agents)

Apache James server versions before 3.9.1 fail to validate file paths in SieveFileRepository, enabling path traversal. A logged-in attacker can write arbitrary Sieve mail scripts for other users, which can cause denial of service or capture their mail traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache James server version and confirm whether it is below `3.9.1`.
- Confirm whether the SieveFileRepository (ManageSieve) feature is in use.

## Fix

- Apache James server: upgrade to `3.9.1`.

## Timeline

- 2026-11-06T12:41:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76168

## From the sources

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.
This allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_