{"id":"CVE-2026-76168","aliases":["EUVD-2026-118219","GHSA-xxqm-m442-hqv7"],"status":"published","title":"Apache James: ManageSieve file implementation cross-user path traversal","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0055,"percentile":0.46478,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-11-06T11:44:44Z","modified":"2026-11-10T18:41:29Z","products":[{"vendor":"apache software foundation","product":"apache james"}],"references":[{"url":"https://lists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdko9oh3qrmdnk2","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/16"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76168"},{"url":"https://github.com/advisories/GHSA-xxqm-m442-hqv7"}],"sources":{"cve":[{"id":"CVE-2026-76168","title":"Apache James: ManageSieve file implementation cross-user path traversal","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","status":"published","published":"2026-11-06T11:44:44.086Z","modified":"2026-11-10T18:41:29.441Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-10T19:39:59.74912Z"}],"euvd":[{"id":"EUVD-2026-118219","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","status":"published","published":"2026-11-06T11:44:44Z","modified":"2026-11-10T18:41:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T20:23:07.469802Z"}],"ghsa":[{"id":"GHSA-xxqm-m442-hqv7","title":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation...","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","status":"published","published":"2026-11-06T12:30:46Z","modified":"2026-11-10T21:32:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-10T21:57:50.285633Z"}],"nvd":[{"id":"CVE-2026-76168","description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","status":"published","published":"2026-11-06T12:17:21.783Z","modified":"2026-11-10T19:21:22.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-10T22:21:31.83577Z"}]}}