The Secure Email Gateway’s web interface fails to validate attachment filenames in GINA‑encrypted emails, allowing a path traversal condition. An attacker can manipulate an attachment name to reference arbitrary files on the gateway, leading to unauthorized disclosure of stored data. This weakness is classified as CWE‑22 and results in a high‑impact confidentiality compromise without affecting integrity or availability directly.

The vulnerability affects SEPPmail Secure Email Gateway versions prior to 15.0.1, as reported by the vendor’s official advisory. All installations using the default web interface and processing GINA‑encrypted attachments are potentially impacted.

With a CVSS score of 9.3, the flaw is considered critical. The EPSS score is under 1 %, indicating low but non‑zero historical exploitation probability, and the issue is not currently listed in the CISA KEV catalog. The likely attack vector is remote: an adversary can send a crafted GINA‑encrypted email to the gateway’s web interface, exploit the filename check failure, and read arbitrary files on the server.