CVE-2026-108120High· 7.7▾ TwilightBrian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended d…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.
sme_server 11.0rc1-215Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108121Medium· 6.9Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
CVE-2026-104806Medium· 5.5DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management …
CVE-2026-104706High· 8.4DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs
CVE-2026-104810High· 8.4This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400