{"id":"CVE-2026-76168","title":"Apache James: ManageSieve file implementation cross-user path traversal","summary":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to…","severity":"none","cwe":["CWE-22"],"vendor":"Apache Software Foundation","product":"Apache James","affected":["apache_james < 3.9.1"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:05:11.062Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76168","references":[{"url":"https://lists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdko9oh3qrmdnk2"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T12:51:23.201Z","slug":"CVE-2026-76168","body":"## Overview\n\nIn Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.\n\n## Affected\n\n- `apache_james < 3.9.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}