{"id":"CVE-2026-108120","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-108120","generatedAt":"2026-10-28T09:28:18.015Z","title":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading…","description":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system logs \ndirectory, including potentially sensitive system and application files.","published":"2026-10-19T06:17:21.000Z","lastModified":"2026-10-19T21:03:43.000Z","status":"Deferred","sourceIdentifier":"vulnerability@ncsc.ch","cvss":{"version":"4.0","score":7.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-31"],"affected":[],"epss":{"score":0.00368,"percentile":0.30477,"date":"2026-10-27","history":[{"date":"2026-10-19","score":0.00368,"percentile":0.29187}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-19T06:17:21.000Z","detail":{"score":"7.7","severity":"HIGH","publishedAt":"2026-10-19T06:17:21.097Z"},"summary":"New CVE, high severity (CVSS 7.7)."}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=koozali","source":"vulnerability@ncsc.ch"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108120","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}