{"id":"CVE-2026-76168","published":"2026-11-06T12:17:21.783","lastModified":"2026-11-10T19:21:22.147","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdko9oh3qrmdnk2","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/16","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache James server prior to 3.9.1 contains a path traversal vulnerability (CWE-22) in SieveFileRepository due to insufficient validation of file paths. This allows an authenticated attacker to write arbitrary Sieve scripts to other users' directories, enabling unauthorized script execution.","exploitability":"Exploitation requires a valid authenticated session and knowledge of target user identifiers; no authentication bypass is involved.","blast_radius":"Successful exploitation enables attackers to cause denial of service via malicious Sieve scripts or intercept/redirect email traffic intended for other users, compromising confidentiality and integrity of communications.","remediation":"Upgrade Apache James server to version 3.9.1 immediately, as this is the exact version that fixes the path traversal vulnerability in SieveFileRepository.","detection":"Defenders should monitor server logs for unusual file write operations to Sieve script directories (e.g., paths containing '..' or unexpected user-specific subdirectories) and anomalous script creation timestamps relative to user activity; look for entries in sieve.log or application logs referencing file path resolution with non-canonicalized paths.","tags":["path-traversal","sieve","email-server","privilege-escalation","dos"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:49:12.416Z"}}