CVE-2026-8811 is a directory traversal vulnerability in SEPPmail AG Secure Email Gateway affecting versions prior to 15.0.5. The vulnerability arises from improper validation of attachment filenames during the generation of encrypted PDFs, enabling an attacker with limited privileges to write files outside the designated directory. This could lead to placing files in locations accessible via the web server, increasing the risk of unauthorized file placement. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on integrity and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor patch releases.

An attacker with limited privileges can exploit this vulnerability to create or overwrite files outside the intended directory structure during encrypted PDF generation. This may allow placing malicious or unauthorized files in web-accessible locations, potentially leading to further compromise or information disclosure. The vulnerability impacts system integrity and availability but does not directly affect confidentiality according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted users only and monitor for unusual file creation activity in web-accessible directories. Avoid exposing the affected SEPPmail Secure Email Gateway to untrusted networks or users. Follow vendor communications closely for updates on patches or official mitigations.