CVE-2026-2743CWE-22CWE-434

SEPPmail User Web Interface Arbitrary File Write to RCE

Critical · published March 5, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT).

This issue affects SeppMail: 15.0.2.1 and before

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
EPSS
0.01055 · 64.1th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-05T06:45Z
EPSS history
Timeline
  • 05 MAR 06:45Z
    SEPPmail User Web Interface Arbitrary File Write to RCE
    cvelistv5