PT-2026-23410 · Seppmail · Seppmail

Published 2026-03-05 · Updated 2026-06-08 · CVE-2026-2743

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y

Name of the Vulnerable Software and Affected Versions SeppMail versions prior to 15.0.2.1

Description The User Web Interface contains a flaw in the large file transfer (LFT) feature. This allows arbitrary file write via path traversal upload, which can lead to remote code execution. Path traversal is a technique that allows an attacker to access or write to files and directories outside the intended folder by using special characters like "../".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2026-2743

Affected Products

Seppmail

References · 14

• 🔥 https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2743 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2743 · Vendor Advisory
• https://twitter.com/lyrie_ai/status/2056915182241058979 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1thlur8/seppmail_secure_email_gateway_faces_major · Reddit Post
• https://twitter.com/InfoGuard_Labs/status/2056379180783112420 · Twitter Post
• https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html · Note
• https://twitter.com/cyberbivash/status/2029475388938654143 · Twitter Post
• https://t.me/CVEtracker/46418 · Telegram Post
• https://labs.infoguard.ch/advisories/seppmail · Note
• https://twitter.com/threatcluster/status/2063931761000620210 · Twitter Post
• https://t.me/cveNotify/163876 · Telegram Post
• https://t.me/cveNotify/164100 · Telegram Post
• https://t.me/cveNotify/154280 · Telegram Post