High severity · published May 8, 2026
CVE-2026-44127
Local File Inclusion (LFI) and Arbitrary File Deletion
8.8
CVSS
14.8%
EPSS
No
On KEV
Description
SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.
Exploitation
Is it being used?
Exploit prediction (EPSS)14.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Secure Email Gateway · SEPPmail AG
before 15.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44127
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44127
downloads.seppmail.com
https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
labs.infoguard.ch
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
More from Secure Email Gateway
9.3
CVE-2026-44125
Missing Authorization in GINAv2
9.3
CVE-2026-44128
Unauthenticated Remote Code Execution
9.2
CVE-2026-44126
Insecure deserialization
8.6
CVE-2026-84830
OS command injection in privileged configuration handling
8.3
CVE-2026-44129
Server-side template injection