CVE-2026-108120: CWE-31 Path traversal: 'dir\..\..\filename' in koozali SME Server
Description
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.
CVSS v4.0
Score 7.7high
Affected software
koozali
SME Server
Weaknesses
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NCSC.ch
- Date Reserved
- 2026-10-09T14:16:12.393Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad5abbc2cdf04f65612240c
Added to database: 10/19/2026, 05:33:48 UTC
Last updated: 10/19/2026, 05:33:48 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.