Vulnerability · Published Nov 4, 2026 · Assigned by NCSC.ch
CVE-2026-114425Forged LFT metadata permits arbitrary file read and deletion
Critical 9.2
In plain English
A critical-severity security flaw in SEPPmail Secure Email Gateway (SEG) from SEPPmail AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEPPmail AG | SEPPmail Secure Email Gateway (SEG) | 0 – before 15.1.1 |
Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N