Seppmail Seppmail vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Seppmail Seppmail: 9 record(s), with affected versions and fixes.
cpe:2.3:a:seppmail:seppmail

CVE-2026-2743 Critical · 9.8 CWE-22 Mar 5, 2026

SEPPmail User Web Interface Arbitrary File Write to RCE

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before

CVE-2026-2748 Medium · 5.3 CWE-295 Mar 4, 2026

S/MIME Certificate Subject Whitespace

SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allowing signature spoofing.

CVE-2026-2747 High · 7.5 CWE-200 Mar 4, 2026

PGP Mixed Plaintext and Encrypted Content

SEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowing exposure of sensitive information to an unauthorized actor.

CVE-2026-2746 Medium · 5.3 CWE-347 Mar 4, 2026

Missing PGP Signature Tag

SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, leaving users unable to detect forged emails.

CVE-2026-27445 Medium · 5.3 CWE-347 Mar 4, 2026

PGP Signature Reflection

SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the expected key, allowing signature spoofing.

CVE-2026-27444 High · 7.5 CWE-436 Mar 4, 2026

Header Email Address Parsing

SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.

CVE-2026-27443 High · 7.5 CWE-20 Mar 4, 2026

S/MIME Decryption Tag Sanitization Bypass

SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.

CVE-2026-27442 High · 7.5 CWE-22 Mar 4, 2026

zip_attachments Path Traversal

The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.

CVE-2026-27441 Critical · 9.8 CWE-78 Mar 4, 2026

PDF Password CMDi

SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.