CVE-2026-8811CWE-22
Path traversal in PDF generation module
High · published June 18, 2026
What it is
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.
The record
Technical detail
- CVSS v4.0
- 7.1 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
- EPSS
- 0.00437 · 36.9th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2026-06-18T09:05Z
EPSS history
Timeline