---
id: CVE-2026-108120
title: path traversal inKoozali - SME Server
summary: "Brian Mariani from DigitalCanion SA has discovered\_a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended d…"
severity: high
cvss: 7.7
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:P/AU:Y/R:A/RE:M/U:Amber
cvssSource: cna
cwe:
  - CWE-31
vendor: koozali
product: SME Server
affected:
  - sme_server 11.0rc1-215
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T18:32:55.920348Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:33:10.143Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108120'
references:
  - url: 'https://digitalcanion.com/en/security-research/#vendor=koozali'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.603Z'
epss: 0.00368
epssPercentile: 0.29187
---

## Overview

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of 
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated 
attacker to access files outside of the intended directory, leading to 
exfiltration of files located outside the intended system logs 
directory, including potentially sensitive system and application files.

## Affected

- `sme_server 11.0rc1-215`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.