Which versions of SEPPmail are affected by EUVD-2026-37866?

SEPPmail Secure Email Gateway versions before 15.0.5 contain a path traversal vulnerability (CVE-2026-8811, CVSS 7.1) enabling authenticated users to write files to web-accessible directories during…. A patch is available.

How to fix or mitigate EUVD-2026-37866?

Within 24 hours: identify all deployed SEPPmail instances and document current versions. Within 7 days: upgrade all instances to SEPPmail Secure Email Gateway version 15.0.5 or later. Within 30 days: verify patch deployment across all systems and review attachment processing logs for exploitation indicators.

SEPPmail EUVD-2026-37866

Q: What is the CVSS score of EUVD-2026-37866?

EUVD-2026-37866 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-8811 HIGH

Path Traversal (CWE-22)

2026-06-18 NCSC.ch

GHSA-hp2p-h743-jhv4

Path Traversal Secure Email Gateway Seppmail Ag

7.1

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-delivered via email but requires the gateway to invoke PDF encryption on a crafted attachment (AC:H), some processing privilege (PR:L), arbitrary file write yields high integrity and low availability impact, no confidentiality loss.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 11:16 EUVD

Analysis Generated

Jun 18, 2026 - 09:47 vuln.today

DescriptionCVE.org

SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.

AnalysisAI

Path traversal in SEPPmail Secure Email Gateway versions before 15.0.5 allows authenticated remote attackers to write files outside the intended directory by manipulating attachment filenames processed during encrypted PDF generation. Files can be placed in web-accessible locations, enabling potential webshell deployment and integrity compromise. No public exploit identified at time of analysis; the issue was reported by NCSC.ch and is fixed in 15.0.5.

Technical ContextAI

SEPPmail is a Secure Email Gateway appliance (CPE: cpe:2.3:a:seppmail_ag:secure_email_gateway) that performs email encryption, signing, and PDF-encryption of attachments. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) here manifests in the attachment-filename handling routine used during the encrypted-PDF generation pipeline: filename input from an inbound message is concatenated into a filesystem path without proper canonicalization or rejection of traversal sequences such as '../', allowing the resulting file to be written outside the gateway's intended working directory and into directories served by the appliance's web interface.

RemediationAI

Vendor-released patch: SEPPmail 15.0.5 - upgrade all SEPPmail Secure Email Gateway instances to 15.0.5 or later as documented in the vendor release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#possible-path-traversal-vulnerability. If immediate patching is not possible, temporarily disable encrypted-PDF attachment generation for inbound mail flows on the gateway to remove the vulnerable code path (trade-off: users who rely on PDF-encrypted delivery will fall back to alternate encryption methods or plain delivery), and restrict network access to the appliance's web interface to trusted management networks only so that any file written into web-accessible directories cannot be retrieved by an external attacker (trade-off: remote administration must go through VPN or jump host). Monitor the appliance filesystem and webroot for unexpected files created by the PDF-generation process until the upgrade is applied.