SeppMail’s large file transfer (LFT) feature permits an attacker to upload files using a path traversal flaw, allowing arbitrary file writes on the host. The written files can contain executable code or web shells, enabling full control of the server. The vulnerability sits on CWE‑22 and CWE‑434 weaknesses: path traversal in the upload handler and unrestricted upload of dangerous file types, respectively. The principal consequence is a breach of confidentiality, integrity, and availability of the mail server and its underlying system.

The flaw impacts SeppMail installations with the User Web Interface, specifically versions 15.0.2.1 and earlier. All environments running these releases, regardless of deployment size or configuration, are susceptible as the LFT feature is enabled by default.

The assigned CVSS score of 10 reflects maximal severity, and the exploitation probability is reported as less than 1 % in EPSS, indicating a rare but plausible threat. The issue is not yet listed in the CISA KEV catalog. Because the attack requires access to the web interface and the ability to submit a file, the most likely vector is an authenticated user who can manipulate file names to bypass directory restrictions. No publicly available exploit code is known, but the high impact warrants immediate remediation.