The vulnerability exists in Apache James server versions older than 3.9.1 due to insufficient validation of file paths in the SieveFileRepository component. A logged‑in user can craft a path that bypasses per‑user isolation and set arbitrary SIEVE scripts for other accounts. This can cause denial of service if a target mailbox becomes corrupted, or it can enable the attacker to capture or modify mail traffic by inserting malicious scripts. The weakness corresponds to the path traversal flaw listed as CWE‑22.

Apache James server, distributed by the Apache Software Foundation, is vulnerable when running any release prior to 3.9.1. Deployments using older versions should upgrade to 3.9.1 to obtain the fixed path validation logic.

The flaw requires authenticated access to the server; once the attacker has an account, no additional privileges are needed to trigger the exploit. No publicly available exploit was referenced in the CVE data and the EPSS score is not available. Because the vulnerability allows direct manipulation of other users' scripts, it poses a significant risk of service disruption or traffic interception, justifying prompt remediation. The CVSS score is not reported, but the severity implied by the ability to corrupt mailboxes or intercept traffic suggests a high impact.