{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/james--3.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-76168"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["James (\u003c 3.9.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache James Server versions prior to 3.9.1 contain an improper input validation vulnerability in the SieveFileRepository component (CVE-2026-76168). An attacker with authenticated access to the ManageSieve service can use path traversal techniques to bypass security boundaries, allowing them to write or overwrite SIEVE scripts associated with other users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a malicious actor to perform unauthorized actions on behalf of other users, including the interception of email traffic or the implementation of denial-of-service conditions by corrupting user-defined SIEVE rules.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache James Server to version 3.9.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eMonitor ManageSieve protocol logs for unusual script management activity.\u003c/li\u003e\n\u003cli\u003eAudit existing SIEVE scripts for unexpected file path references or suspicious redirect/discard rules that may indicate prior exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:22:54Z","date_published":"2026-11-06T17:22:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-james-path-traversal/","summary":"Apache James versions prior to 3.9.1 are vulnerable to a path traversal flaw in the SieveFileRepository, allowing authenticated attackers to inject malicious SIEVE scripts into other users accounts.","title":"Apache James: ManageSieve cross-user path traversal (CVE-2026-76168)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-james-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - James (\u003c 3.9.1)","version":"https://jsonfeed.org/version/1.1"}