SEPPmail Secure Email Gateway Unauthenticated Path Traversal Vulnerability Allowing Arbitrary File Read and Deletion

A path traversal vulnerability has been identified in SEPPmail Secure Email Gateway versions prior to 15.0.4. This vulnerability allows remote attackers to access arbitrary local files and delete files in the targeted directory, using the privileges of the api.app process. The issue arises in the identifier parameter of the /api.app/attachment/preview endpoint, where improper validation allows for unauthorized file manipulation.

Impact

Exploitation of this vulnerability could lead to unauthorized access and deletion of files on the server, potentially causing data loss or disruption of service.

Remediation

Users can update to SEPPmail Secure Email Gateway version 15.0.4 or later to address this vulnerability.