Koozali SME Server vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Koozali SME Server: 2 record(s), with affected versions and fixes.
CVE-2026-108121
Medium · 6.9
CWE-20 Oct 19, 2026
Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's
SME Server version 11.0rc1-215, allowing an attacker with high privileges
to inject reserved Apache configuration directives, corrupting
httpd.conf and preventing Apache from starting after a server reboot,
resulting in a denial-of-service (DoS) condition affecting the web
server and its hosted virtual hosts.
CVE-2026-108120
High · 7.7
CWE-31 Oct 19, 2026
path traversal inKoozali - SME Server
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated
attacker to access files outside of the intended directory, leading to
exfiltration of files located outside the intended system logs
directory, including potentially sensitive system and application files.