PT-2026-22888 · Seppmail · Seppmail Secure Email Gateway

Andris Suter-Dörig + 2 · Published 2026-03-04 · Updated 2026-03-06 · CVE-2026-27442

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions SEPPmail Secure Email Gateway versions prior to 15.0.1

Description The GINA web interface does not properly validate attachment filenames within GINA-encrypted emails. This allows an attacker to potentially access files on the gateway. The issue resides in the handling of filenames during the decryption process. The vulnerable component is the GINA web interface.

Recommendations Update SEPPmail Secure Email Gateway to version 15.0.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-27442

Affected Products

Seppmail Secure Email Gateway

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-27442 · Security Note
• https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27442 · Vendor Advisory
• https://twitter.com/CCBalert/status/2029593354787332165 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029127449963892927 · Twitter Post
• https://twitter.com/autumn_good_35/status/2029942070346138065 · Twitter Post
• https://twitter.com/CVEnew/status/2029125969827475816 · Twitter Post
• https://twitter.com/CVEarity/status/2029240301467123832 · Twitter Post
• https://t.me/CVEtracker/46295 · Telegram Post
• https://t.me/cveNotify/154346 · Telegram Post