{"id":"CVE-2026-108120","title":"path traversal inKoozali - SME Server","summary":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended d…","severity":"high","cvss":7.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:P/AU:Y/R:A/RE:M/U:Amber","cvssSource":"cna","cwe":["CWE-31"],"vendor":"koozali","product":"SME Server","affected":["sme_server 11.0rc1-215"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T18:32:55.920348Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:33:10.143Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108120","references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=koozali"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T07:09:59.603Z","epss":0.00368,"epssPercentile":0.29187,"slug":"CVE-2026-108120","body":"## Overview\n\nBrian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system logs \ndirectory, including potentially sensitive system and application files.\n\n## Affected\n\n- `sme_server 11.0rc1-215`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}