CVE-2026-2743

CRITICAL

SeppMail <=15.0.2.1 - Path Traversal to RCE

Title source: llm

Description

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before

References (3)

Core 3

Core References

Various Sources

https://labs.infoguard.ch/advisories/seppmail

Various Sources

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html

https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/

Scores

CVSS v3 9.8

EPSS 0.0076

EPSS Percentile 50.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-22 CWE-434

Status published

Products (2)

seppmail/seppmail < 15.0.2.1

SeppMail/SeppMail < 15.0.2.1

Published Mar 05, 2026

Tracked Since Mar 05, 2026