Cyber ·
CVE-2026-76168: Apache James allows path traversal between users in ManageSieve file handling
Security advisory published on November 6, 2026 describing a path traversal flaw in Apache James before version 3.9.1, which may let an authenticated user set SIEVE scripts for other users, causing denial of service or traffic capture.
According to the text received, advisory CVE-2026-76168 concerns incorrect path validation used by the SieveFileRepository in Apache James. The flaw affects versions before 3.9.1 and is rated as important severity. A connected attacker can set arbitrary SIEVE scripts for other users, which may result in denial of service or even traffic capture. The content was posted by a project contributor to the oss-sec feed on November 6, 2026. The available text is an automatic translation and is cut off at the update recommendation, so the exact version to adopt should be confirmed in the original. To verify, consult the original advisory in the oss-sec list archive and the Apache James project release notes. Rota Nacional does not operate or fix mail servers, and this item does not describe any platform capability. The relevance lies in inventory: teams running Apache James should identify instances below 3.9.1 and plan the upgrade.