James (< 3.9.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/james--3.9.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:22:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache James: ManageSieve cross-user path traversal (CVE-2026-76168)https://feed.craftedsignal.io/briefs/2026-11-apache-james-path-traversal/Fri, 06 Nov 2026 17:22:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-james-path-traversal/Apache James versions prior to 3.9.1 are vulnerable to a path traversal flaw in the SieveFileRepository, allowing authenticated attackers to inject malicious SIEVE scripts into other users accounts.Apache James Server versions prior to 3.9.1 contain an improper input validation vulnerability in the SieveFileRepository component (CVE-2026-76168). An attacker with authenticated access to the ManageSieve service can use path traversal techniques to bypass security boundaries, allowing them to write or overwrite SIEVE scripts associated with other users.

Impact

Successful exploitation allows a malicious actor to perform unauthorized actions on behalf of other users, including the interception of email traffic or the implementation of denial-of-service conditions by corrupting user-defined SIEVE rules.

Recommendation

  • Upgrade Apache James Server to version 3.9.1 or later immediately.
  • Monitor ManageSieve protocol logs for unusual script management activity.
  • Audit existing SIEVE scripts for unexpected file path references or suspicious redirect/discard rules that may indicate prior exploitation.
]]>highadvisory