SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access

"Critical security vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade email security solution, that could be exploited to achieve remote code execution and enable an attacker to read arbitrary mails from the virtual appliance."

"CVE-2026-2743 (CVSS score: 10.0) - A path traversal vulnerability in the SeppMail User Web Interface's large file transfer (LFT) feature that could enable arbitrary file write, resulting in remote code execution. CVE-2026-44127 (CVSS score: 8.8) - An unauthenticated path traversal vulnerability in "/api.app/attachment/preview" that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the "api.app" process."

"CVE-2026-44126 (CVSS score: 9.2) - A deserialization of untrusted data vulnerability that allows unauthenticated remote attackers to execute code via a crafted serialized object. CVE-2026-44128 (CVSS score: 9.3) - An eval injection vulnerability that allows unauthenticated remote code execution by taking advantage of the fact that the /api.app/template feature directly passes user-supplied upldd parameter into a Perl eval() statement without any sanitization."

"CVE-2026-7864 (CVSS score: 6.9) - An exposure of sensitive system information vulnerability that leaks server environment variables through an unauthenticated endpoint in the new GINA UI. CVE-2026-44125 (CVSS score: 9.3) - A missing authorization check vulnerability for multiple endpoints in the new GINA UI that allows unauthenticated remote attackers to access functionality that would otherwise require a valid session."

Critical vulnerabilities were disclosed in SEPPMail Secure E-Mail Gateway that could be exploited for remote code execution and unauthorized mail access. A path traversal flaw in the User Web Interface large file transfer feature could allow arbitrary file write, leading to code execution. The new GINA UI contains an unauthenticated endpoint that leaks server environment variables, and multiple endpoints missing authorization checks that allow unauthenticated access to session-restricted functionality. Untrusted data deserialization enables unauthenticated code execution through crafted serialized objects. Additional issues include unauthenticated path traversal in an attachment preview endpoint that permits reading local files and deleting files with the api.app process privileges, and an eval injection in a template feature that passes user input into a Perl eval call without sanitization.

Read at The Hacker News