# CVE-2026-114425: Forged LFT metadata permits arbitrary file read and deletion

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 9.2 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-73

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

5 posts seen since 2026-11-04.

- x 2026-11-04: 🆕 New CVE: CVE-2026-114425 (CVSS 9.2) SEPPmail Secure Email Gateway (SEG) · Information disclosure Remote, no login needed.  SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment…  https://t.co/cDf7EoPaOZ (https://x.com/EnclaveRadar/status/2117914918926110825)
- bluesky 2026-11-04: CVE-2026-114425 - seppmail secure email gateway (seg) The SEPPmail Secure Email Gateway can be tricked by a specially crafted large file transfer attachment to read, move, or delete files on the server. This can…  Too many irrelevant or confusing CVEs? Use stackflag.com  #seppma… (https://bsky.app/profile/stackflag.bsky.social/post/3mzi2oz2zbr2t)
- bluesky 2026-11-04: CVE-2026-114425 - Forged LFT metadata permits arbitrary file read and deletion CVE ID : CVE-2026-114425    Published : Nov. 4, 2026, 8:29 a.m. \| 35 minutes ago    Description : SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large... (https://bsky.app/profile/cve.skyfleet.blue/post/alx2h3bo2fxop)
- bluesky 2026-11-04: SEPPmail SEG <15.1.1 hit by CRITICAL vuln (CVE-2026-114425): Unauth users can control file paths via LFT, risking root file access. Upgrade to 15.1.1+ now. https://radar.offseq.com/threat/cve-2026-114425-cwe-73-external-control-of-file-name-or-path-in-seppmail-ag-seppmail-secure… (https://bsky.app/profile/offseq.bsky.social/post/3mzhyiignsp27)
- x 2026-11-04: Running SEPPmail? Unauthenticated RCE as root, fixed in 15.1.1  CVE-2026-114424 (CVSS 4.0 9.2, CNA https://t.co/G4vAXiAGL5): address rewrite rules can run sender text as Perl. CVE-2026-114425 (9.2) allows file read/delete. Exploitation not stated.  https://t.co/Ep6LfjEf7f  #CVE… (https://x.com/EmunaEliran/status/2117901260644864418)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-114425 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-114425