SeppMail User Web Interface Path Traversal Vulnerability Leading to Arbitrary File Write and Remote Code Execution

A vulnerability in the SEPPmail User Web Interface's large file transfer feature allows for arbitrary file writes via path traversal, potentially leading to remote code execution. This issue affects SEPPmail versions through 15.0.2.1.

Impact

Exploitation of this vulnerability could result in unauthorized file writes, which may be leveraged to execute arbitrary code on the server.

Reproduction

The vulnerability can be reproduced by uploading a file through the large file transfer feature in the SEPPmail User Web Interface. The upload process can be manipulated to include path traversal sequences, allowing the uploaded file to be written outside of the intended directory. Once the file is uploaded, any executable code contained within can be executed on the server.

Remediation

Users are advised to update to SEPPmail version 15.0.3, which addresses this vulnerability.