CVE-2026-108120
7.7HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-31
Impact
Unauthenticated remote attackers can read arbitrary system and application files outside the logs directory over the network. They need network access to the SME Server web interface.
Root cause
A path traversal flaw in the View Logs functionality fails to sanitize file paths before displaying contents.
Affected systems
Koozali SME Server version 11.0rc1-215
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber
Fix & remediation
No fixed version is specified in the advisory; restrict network access to the SME Server web management interface or disable the administrative web interface from untrusted networks until a patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.