Apache James: ManageSieve cross-user path traversal (CVE-2026-76168)

Apache James Server versions prior to 3.9.1 contain an improper input validation vulnerability in the SieveFileRepository component (CVE-2026-76168). An attacker with authenticated access to the ManageSieve service can use path traversal techniques to bypass security boundaries, allowing them to write or overwrite SIEVE scripts associated with other users.

Impact

Successful exploitation allows a malicious actor to perform unauthorized actions on behalf of other users, including the interception of email traffic or the implementation of denial-of-service conditions by corrupting user-defined SIEVE rules.

Recommendation

• Upgrade Apache James Server to version 3.9.1 or later immediately.
• Monitor ManageSieve protocol logs for unusual script management activity.
• Audit existing SIEVE scripts for unexpected file path references or suspicious redirect/discard rules that may indicate prior exploitation.