CVE-2026-108120 is a path traversal vulnerability in the View Logs feature of Koozali's SME Server version 11.0rc1-215. The flaw allows an unauthenticated attacker to request files outside the intended system logs directory by manipulating the path parameter, leading to unauthorized file disclosure, including potentially sensitive system and application data. This weakness is classified as CWE-31 and can compromise confidentiality.

The affected product is Koozali SME Server, specifically the 11.0rc1-215 release. Users running this version or earlier releases of the View Logs component are susceptible to the exploitation described above.

The CVSS score of 7.7 indicates a high severity impact. Since the attack requires no authentication, it is broadly available to any network user that can reach the SME Server. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the lack of a known exploit does not reduce the inherent risk of data exfiltration. An attacker can craft a request to the View Logs endpoint with a path containing '..' sequences to read arbitrary files.