---
id: CVE-2026-108121
title: >-
  Koozali - SME Server Improper Input Validation in domain Creation Leads to
  Denial of Service
summary: "Brian Mariani from DigitalCanion SA has discovered\_a\_ vulnerability in the domain creation functionality of koozali's \nSME Server version 11.0rc1-215, allowing an attacker with high privileges \nto inject reserved Apache configuration dir…"
severity: medium
cvss: 6.9
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:P/S:P/AU:Y/R:A/RE:M/U:Amber
cvssSource: cna
cwe:
  - CWE-20
  - CWE-96
  - CWE-400
vendor: Koozali
product: SME Server
affected:
  - sme_server 11.0rc1-215
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T17:35:53.792314Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T17:36:10.887Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108121'
references:
  - url: 'https://digitalcanion.com/en/security-research/#vendor=koozali'
tags:
  - cve.org
epss: 0.00309
epssPercentile: 0.223
ingestedAt: '2026-10-19T07:09:59.603Z'
---

## Overview

Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's 
SME Server version 11.0rc1-215, allowing an attacker with high privileges 
to inject reserved Apache configuration directives, corrupting 
httpd.conf and preventing Apache from starting after a server reboot, 
resulting in a denial-of-service (DoS) condition affecting the web 
server and its hosted virtual hosts.

## Affected

- `sme_server 11.0rc1-215`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.