Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108121— Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

Quick assessment

Affected
Koozali SME Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DigitalCanion SA 的 Brian Mariani 在 koozali 的 SME Server 11.0rc1-215 版本的域名创建功能中发现了一个漏洞。该漏洞允许拥有高权限的攻击者注入保留的 Apache 配置指令，从而破坏 httpd.conf 文件，导致服务器重启后 Apache 无法启动，进而引发拒绝服务（DoS）攻击，影响 Web 服务器及其托管的虚拟主机。

CVSS 6.9 · Medium EPSS 0.31% · P22

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
Koozali SME Server 11.0rc1-215 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108121

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:P/S:P/AU:Y/R:A/RE:M/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Koozali SME Server 11.0rc1-215 -

II. Public POCs for CVE-2026-108121

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108121

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: SME Server
Same vendor: Koozali
Same weakness: CWE-20

V. Comments for CVE-2026-108121

No comments yet

Leave a comment