Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-108120: SME Server lets attackers read arbitrary files via logs
CVE-2026-108120 · published 16 days ago
Summary
Version 11.0rc1-215 of SME Server’s View Logs feature can be tricked into revealing files outside the logs folder, even without logging in. This could expose system or application data that should remain private. Apply the vendor’s update or patch and limit access to the logs page while the fix is deployed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| koozali | sme server | 11.0rc1-215 |
Original advisory text
path traversal inKoozali - SME Server
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated
attacker to access files outside of the intended directory, leading to
exfiltration of files located outside the intended system logs
directory, including potentially sensitive system and application files.
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated
attacker to access files outside of the intended directory, leading to
exfiltration of files located outside the intended system logs
directory, including potentially sensitive system and application files.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.7
High
Type
CWE-31Path Traversal: 'dir\..\..\filename'
Timeline
Published19 Oct 2026
Updated4 Nov 2026
First seen19 Oct 2026
Track software like this
Free during beta