CVE-2026-108120

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.

CVSS

No CVSS.

References

Link	Resource
https://digitalcanion.com/en/security-research/#vendor=koozali

Configurations

No configuration.

History

19 Oct 2026, 06:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-19 06:17

Updated : 2026-10-19 21:03

NVD link : CVE-2026-108120

Mitre link : CVE-2026-108120

CVE.ORG link : CVE-2026-108120

JSON object : View

Products Affected

No product.

CWE

CWE-31

Path Traversal: 'dir\..\..\filename'

{"id": "CVE-2026-108120", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108120", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T18:32:55.920348Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 7.7, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "koozali", "product": "SME Server", "versions": [{"status": "affected", "version": "11.0rc1-215"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-10-19T06:17:21.097", "references": [{"url": "https://digitalcanion.com/en/security-research/#vendor=koozali", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-31"}]}], "descriptions": [{"lang": "en", "value": "Brian Mariani from DigitalCanion SA has discovered\u00a0a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system logs \ndirectory, including potentially sensitive system and application files."}], "lastModified": "2026-10-19T21:03:42.880", "sourceIdentifier": "vulnerability@ncsc.ch"}

CVE-2026-108120

JSON object

Attach tags to CVE-2026-108120

Attach tags to `CVE-2026-108120`