SEPPmail AG Secure Email Gateway prior to version 15.0.4 contains a CWE-73 external control of file name or path vulnerability. Specifically, the identifier parameter in the /api.app/attachment/preview API endpoint is vulnerable to unauthenticated path traversal. This allows remote attackers to read arbitrary files on the local system and delete files in the targeted directory with the permissions of the api.app process. The vulnerability is remotely exploitable without authentication or user interaction, resulting in high impact on confidentiality and limited impact on integrity. The CVSS 4.0 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Successful exploitation allows remote attackers to read any local files accessible by the api.app process and delete files in the targeted directory, potentially leading to data disclosure and data loss. The attacker gains these capabilities without authentication, increasing the risk. The vulnerability affects confidentiality and integrity of the system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, organizations should monitor SEPPmail AG advisories for updates. Until a patch is available, restricting network access to the vulnerable endpoint and applying compensating controls may reduce exposure.