CVE-2022-41871 Command injection in SEPPmail

What is CVE-2022-41871?

CVE-2022-41871 is a medium-severity command injection vulnerability in SEPPmail, published on 28 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute arbitrary code in the context of the user root.

Weakness: CWE-78

Which versions are affected by CVE-2022-41871?

It affects 1 product.

Products include Seppmail Seppmail.

How do I fix CVE-2022-41871?

No fix has been published for CVE-2022-41871 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-41871 being exploited?

There is no known exploitation of CVE-2022-41871 in the wild and no public exploit code.

Other vulnerabilities in SEPPmail

• CVE-2026-2743 SEPPmail User Web Interface Arbitrary File Write to RCE Critical 10.0
• CVE-2026-27441 PDF Password CMDi Critical 9.5
• CVE-2026-27442 zip_attachments Path Traversal Critical 9.3
• CVE-2026-27443 S/MIME Decryption Tag Sanitization Bypass High 8.2
• CVE-2026-27444 Header Email Address Parsing High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9mh9-7p8c-gr7g.