CVE-2026-76168

Summary

Apache James server prior to 3.9.1 contains a path traversal vulnerability (CWE-22) in SieveFileRepository due to insufficient validation of file paths. This allows an authenticated attacker to write arbitrary Sieve scripts to other users' directories, enabling unauthorized script execution.

Exploitability

Exploitation requires a valid authenticated session and knowledge of target user identifiers; no authentication bypass is involved.

Blast radius

Successful exploitation enables attackers to cause denial of service via malicious Sieve scripts or intercept/redirect email traffic intended for other users, compromising confidentiality and integrity of communications.

Detection

Defenders should monitor server logs for unusual file write operations to Sieve script directories (e.g., paths containing '..' or unexpected user-specific subdirectories) and anomalous script creation timestamps relative to user activity; look for entries in sieve.log or application logs referencing file path resolution with non-canonicalized paths.

Prioritized remediation

Upgrade Apache James server to version 3.9.1 immediately, as this is the exact version that fixes the path traversal vulnerability in SieveFileRepository.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.