Vulnerability · Published Jun 18, 2026 · Assigned by NCSC.ch
CVE-2026-8811Path traversal in PDF generation module
High 7.1
In plain English
A high-severity path traversal in Secure Email Gateway from SEPPmail AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEPPmail AG | Secure Email Gateway | 0 – before 15.0.5 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L