Skip to content
OpenAdvisories
High WID-SEC-2026-4349 5 CVEs

SEPPmail Secure E-Mail Gateway: Mehrere Schwachstellen

Published Nov 4, 2026 · Updated Nov 4, 2026 · de-DE

Vendor: SEPPmail Product: Secure E-Mail Gateway Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in SEPPmail Secure E-Mail Gateway ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

SEPPmail Secure E-Mail Gateway ist eine Lösung zum Schutz der E-Mail-Kommunikation durch Verschlüsselung und Signierung.

Vulnerabilities 5

  • Critical 9.2
    CVE-2026-114424

    Code execution through double evaluation in address replacement rules

    SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context w…

    SEPPmail SEPPmail Secure Email Gateway (SEG)
  • Critical 9.2
    CVE-2026-114425

    Forged LFT metadata permits arbitrary file read and deletion

    SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular fi…

    SEPPmail SEPPmail Secure Email Gateway (SEG)
  • High 8.7
    CVE-2026-114426

    Pre-authentication upload parsing permits resource exhaustion

    SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage wit…

    SEPPmail SEPPmail Secure Email Gateway (SEG)
  • High 8.3
    CVE-2026-114421

    Empty initial password permits GINA account takeover

    SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set …

    SEPPmail SEPPmail Secure Email Gateway (SEG)
  • Medium 6.9
    CVE-2026-114420

    LDAP wildcard injection exposes GINA recipient accounts

    SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.

    SEPPmail SEPPmail Secure Email Gateway (SEG)

Revision history

  1. #1

    Initiale Fassung

References