{"id":"CVE-2026-108121","title":"Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service","summary":"Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's \nSME Server version 11.0rc1-215, allowing an attacker with high privileges \nto inject reserved Apache configuration dir…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:P/S:P/AU:Y/R:A/RE:M/U:Amber","cvssSource":"cna","cwe":["CWE-20","CWE-96","CWE-400"],"vendor":"Koozali","product":"SME Server","affected":["sme_server 11.0rc1-215"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T17:35:53.792314Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T17:36:10.887Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108121","references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=koozali"}],"tags":["cve.org"],"epss":0.00309,"epssPercentile":0.223,"ingestedAt":"2026-10-19T07:09:59.603Z","slug":"CVE-2026-108121","body":"## Overview\n\nBrian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's \nSME Server version 11.0rc1-215, allowing an attacker with high privileges \nto inject reserved Apache configuration directives, corrupting \nhttpd.conf and preventing Apache from starting after a server reboot, \nresulting in a denial-of-service (DoS) condition affecting the web \nserver and its hosted virtual hosts.\n\n## Affected\n\n- `sme_server 11.0rc1-215`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}