EUVD-2026-104070
GHSA-wj5h-2j88-93vj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SME Server web interface remotely
-
ExploitInject path-traversal sequence into View Logs parameter
-
ExecutionRead files outside the log directory
-
ImpactExfiltrate sensitive system and application files
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The exact prerequisite is network reachability to the SME Server web/server-manager 'View Logs' functionality; no authentication is required (PR:N) and no user interaction is needed (UI:N), so default-configuration instances are exploitable by anyone who can reach the management interface. The attack is automatable (AU:Y) and low-complexity (AC:L). The principal LIMIT on real-world exploitation is scope of exposure: the flaw is documented against the specific release-candidate build 11.0rc1-215 of Koozali SME Server, a low-footprint product, and typical hardened deployments do not expose the server-manager interface to untrusted networks. Impact is confined to file disclosure (confidentiality) - there is no write, integrity, or availability effect. |
| Impact | Signals are moderately consistent and point to a real-but-bounded confidentiality risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an easy, remote, unauthenticated read primitive, and AU:Y (Automatable=Yes) plus E:P (Exploit maturity = Proof-of-Concept) raise the practical likelihood of mass scanning. Impact is confidentiality-only (VC:H, VI:N, VA:N) with no scope change to other systems (SC/SI/SA:N), so this is file disclosure - not code execution - which caps the real-world severity below the first impression of a 'high' score. The strongest mitigating signal is the affected target: the description pins the flaw to version 11.0rc1-215, a release candidate of Koozali SME Server, a niche open-source SMB Linux distribution with a small production footprint. There is NO CISA KEV listing (not confirmed actively exploited) and NO EPSS score was provided, so widespread opportunistic exploitation cannot be asserted from the data. Net: a credible, automatable unauthenticated information-disclosure issue worth prompt patching for the few organizations running this specific RC build, but not a broad ecosystem emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches the SME Server web management interface and supplies crafted path-traversal sequences (e.g. ../../) to the 'View Logs' functionality, causing the server to return files outside the intended log directory such as configuration files or /etc/passwd. The CVSS 4.0 vector reports Proof-of-Concept exploit maturity (E:P), so working exploit code is indicated; AC:L and AU:Y mean the request is simple and easily scripted at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Path traversal in Koozali SME Server 11.0rc1-215 allows remote unauthenticated attackers to read files outside the intended logs directory through the server-manager View Logs feature, exposing system and application files with high confidentiality impact but no integrity or availability effect. The CVSS 4.0 vector rates exploitation maturity as E:P, so publicly available exploit code exists at the proof-of-concept level, but there is no CISA KEV confirmation of active exploitation. Real-world exposure is bounded to instances whose administrative web interface is reachable from untrusted networks.
RemediationAI
No vendor-released patch or exact fixed version is identified in the provided data, so track the vendor advisory at https://digitalcanion.com/en/security-research/#vendor=koozali and upgrade to a corrected SME Server build as soon as one is published; because 11.0rc1-215 is a release candidate, treat it as unsuitable for exposed production management interfaces. Until a fix is available, restrict reachability to the SME Server server-manager and View Logs interface to trusted management networks through firewall rules, VPN, or reverse-proxy allowlists, accepting that legitimate remote administration must use that controlled path. If log viewing is not required, disable or block the View Logs feature at the web server or reverse proxy, with the trade-off of losing that diagnostic capability, and monitor web-access logs for traversal sequences; segregation of the management interface on a dedicated VLAN adds operational overhead but limits exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is in the View Logs function of Koozali SME Server's server-manager, which takes a user-controlled log/file selection over the network and resolves it against the intended logs directory. CWE-31 describes a path traversal variant where directory-separator and dot-dot sequences are not neutralized, so the resolved path can escape the logs root and disclose arbitrary files readable by the server-manager process. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y) and the independent CVSS 3.1 assessment agree on network reachability, no authentication, no user interaction, high confidentiality impact, and no integrity or availability effect. CPE cpe:2.3:a:koozali:sme_server:*:*:*:*:*:*:*:* identifies the SME Server product family, while the reported affected build is 11.0rc1-215.
Know when Sme Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:P/AU:Y/R:A/RE:M/U:Amber
Remote unauthenticated path traversal over the web interface (AV:N/AC:L/PR:N/UI:N); arbitrary file read gives C:H, with no integrity or availability impact and no scope change.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
DescriptionCVE.org
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.
Executive ViewAI
Koozali SME Server 11.0rc1-215 exposes system and application files through a path traversal flaw in the server-manager View Logs feature, creating a confidentiality risk for organizations that expose that administrative interface to untrusted networks. Publicly available exploit code exists, and no vendor-released patch is identified at time of analysis, so leadership should treat any internet-reachable management interface as elevated risk and prioritize containment while a fix is pending.
Restrict the server-manager administrative interface and View Logs feature to trusted management networks or VPN; block external access at the perimeter; deploy reverse-proxy or WAF rules that normalize paths and reject traversal sequences; monitor logs for anomalous file-read attempts; apply the vendor update when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Sme Server
View allHigh-privilege authenticated administrators of Koozali SME Server 11.0rc1-215 can inject reserved Apache configuration d
Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user w
Exploit-DB