Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-76168— Apache James: ManageSieve file implementation cross-user path traversal

Quick assessment

Affected

Apache Software Foundation Apache James

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 3.9.1 版本之前的 Apache James 服务器中，由于 SieveFileRepository 组件对文件路径的验证存在缺陷，可能导致路径遍历漏洞。该漏洞允许已登录的攻击者为其他用户设置任意 SIEVE 脚本，进而引发拒绝服务攻击，甚至导致流量被窃取。建议用户升级至 3.9.1 版本，该版本已修复此问题。

AI Predicted 7.5 Difficulty: Moderate Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1562 T1190 · Exploit Public-Facing Application

Updated Nov 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache James: ManageSieve file implementation cross-user path traversal

Source: CVE Program / CVE List V5

Vulnerability Description

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache James	0 ~ 3.9.1	-

II. Public POCs for CVE-2026-76168

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-76168

请登录查看更多情报信息。

Other References for CVE-2026-76168 (1)

https://lists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdko9oh3qrmdnk2 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-76168

Same Patch Batch · Apache Software Foundation · 2026-11-06 · 7 CVEs total

CVE-2026-85111	8.7 HIGH	Apache James: Denial of service upon MIME parsing
CVE-2025-66621		Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
CVE-2026-49939		Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
CVE-2026-76171		Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2026-74756		Apache James: WebAdmin exposed without authentication on official Docker default
CVE-2026-85108		Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Th

IV. Related Vulnerabilities

Same product: Apache James

Same vendor: Apache Software Foundation

Same weakness: CWE-22