GitHub Advisory

nvd.nist.gov • June 8, 2026

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before

View Analysis Description

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability CVE-2026-2743 in SeppMail Exposes Users to Remote Code Execution CVE-2026-2743 is a critical vulnerability with a CVSS score of 9.8, affecting SeppMail versions 15.0.2.1 and earlier. The vulnerability allows arbitrary file write via path traversal, leading to potential remote code execution through the large file transfer feature. Active exploits have been reported, and no official patch is currently available, necessitating immediate mitigation efforts. The EPSS indicates a 30-day exploitation probability, emphasizing the urgency of addressing this issue. Security professionals are advised to validate their environments against this vulnerability using available tools. The vulnerability was published on March 5, 2026, and has since been updated with enrichment data from the NVD. 2 sources 75

Extracted Entities

GitHub Advisory

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)