Vulnerability · Published May 8, 2026 · Assigned by NCSC.ch
CVE-2026-44127Local File Inclusion (LFI) and Arbitrary File Deletion
High 8.8
In plain English
A high-severity security flaw in Secure Email Gateway from SEPPmail AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.8% (higher than 97% of all known vulnerabilities).
Severity (CVSS 4.0)8.8High
Exploit odds (30 days)14.8%top 3.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEPPmail AG | Secure Email Gateway | 0 – before 15.0.4 |
Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N