SEPPmail Secure Email Gateway: Arbitrary file manipulation via Large File Transfer (CVE-2026-114425)

SEPPmail Secure Email Gateway versions before 15.1.1 are susceptible to unauthenticated arbitrary file read, move, or delete attacks. The vulnerability exists within the Large File Transfer (LFT) feature, which incorrectly trusts externally provided file path metadata. Attackers can leverage this to manipulate files processed by the mail-worker, which executes with root privileges. This vulnerability is identified as CVE-2026-114425.

Impact

Successful exploitation allows an unauthenticated remote attacker to read, move, or delete arbitrary files on the system with root-level privileges, potentially leading to full system compromise or information disclosure of sensitive email data.

Recommendation

• Upgrade SEPPmail Secure Email Gateway to version 15.1.1 or later immediately.
• If patching is not immediately feasible, disable the Large File Transfer (LFT) feature on internet-facing SEPPmail gateways until the update can be applied.
• Audit system logs for unexpected file deletions or access attempts targeting critical system configuration files.