PT-2026-22888

CVE-2026-27442

Published

2026-03-04

Updated

2026-03-06

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions SEPPmail Secure Email Gateway versions prior to 15.0.1

Description The GINA web interface does not properly validate attachment filenames within GINA-encrypted emails. This allows an attacker to potentially access files on the gateway. The issue resides in the handling of filenames during the decryption process. The vulnerable component is the GINA web interface.

Recommendations Update SEPPmail Secure Email Gateway to version 15.0.1 or later.

Exploitability

Fix

Impacts

Researchers

Andris Suter-Dörig

Kenny Paterson

Matteo Scarlata

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')