{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/secure-email-gateway--15.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:seppmail:secure_email_gateway:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-114425"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Secure Email Gateway (\u003c 15.1.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SEPPmail"],"content_html":"\u003cp\u003eSEPPmail Secure Email Gateway versions before 15.1.1 are susceptible to unauthenticated arbitrary file read, move, or delete attacks. The vulnerability exists within the Large File Transfer (LFT) feature, which incorrectly trusts externally provided file path metadata. Attackers can leverage this to manipulate files processed by the mail-worker, which executes with root privileges. This vulnerability is identified as CVE-2026-114425.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to read, move, or delete arbitrary files on the system with root-level privileges, potentially leading to full system compromise or information disclosure of sensitive email data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SEPPmail Secure Email Gateway to version 15.1.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, disable the Large File Transfer (LFT) feature on internet-facing SEPPmail gateways until the update can be applied.\u003c/li\u003e\n\u003cli\u003eAudit system logs for unexpected file deletions or access attempts targeting critical system configuration files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T12:00:43Z","date_published":"2026-11-04T12:00:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-seppmail-file-manipulation/","summary":"SEPPmail Secure Email Gateway versions prior to 15.1.1 are vulnerable to arbitrary file read, move, or delete operations due to improper validation of metadata in Large File Transfer attachments.","title":"SEPPmail Secure Email Gateway: Arbitrary file manipulation via Large File Transfer (CVE-2026-114425)","url":"https://feed.craftedsignal.io/briefs/2026-11-seppmail-file-manipulation/"}],"language":"en","title":"CraftedSignal Threat Feed - Secure Email Gateway (\u003c 15.1.1)","version":"https://jsonfeed.org/version/1.1"}