{"affected":[{"defaultStatus":"unaffected","product":"Apache James","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.9.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-76168","cwes":["CWE-22"],"description":"In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.\nThis allows a logged in attacker  to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793965484086,"publishedAt":1793965484086,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/rpp3rx9zzn2hs3kp3kdko9oh3qrmdnk2"}],"remediation":[],"revision":"887eccefdde0d69247e233508f6b46081071f773f44d90c464b527b6a20e32ab","sources":[{"modifiedAt":1793965484086,"name":"CNA: apache","retrievedAt":1793967004622,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76168"}],"ssvc":null,"status":"published","title":"Apache James: ManageSieve file implementation cross-user path traversal","updatedAt":1793967004622}