SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability (CWE-73) in the identifier parameter of the /api.app/attachment/preview endpoint. This flaw allows remote attackers to read arbitrary files on the local system and delete files within the targeted directory, executing these actions with the privileges of the api.app process. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 8.8, indicating high severity. No official patch or remediation guidance has been published by SEPPmail AG as of the current information.

Successful exploitation enables remote attackers to read any local files accessible by the api.app process and delete files within the targeted directory. This can lead to unauthorized disclosure of sensitive information and potential disruption or loss of data. The vulnerability requires no authentication, increasing the risk of exploitation. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the vulnerable endpoint where possible and monitor for suspicious activity related to the /api.app/attachment/preview API. Avoid exposing the Secure Email Gateway to untrusted networks. Apply the official patch promptly once it becomes available.