CVE-2026-2743 SEPPmail User Web Interface Arbitrary File Write to RCE

Critical 10.0 Published 5 Mar 2026 Updated 19 May 2026

Attackers can achieve remote code execution via arbitrary file write in the large file transfer feature of the SeppMail user web interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-2743?

CVE-2026-2743 is a critical vulnerability in SeppMail, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT).

This issue affects SeppMail: 15.0.2.1 and before

Weakness: CWE-434, CWE-22

Which versions are affected by CVE-2026-2743?

It affects 1 product.

Products include Seppmail Seppmail.

How do I fix CVE-2026-2743?

No fix has been published for CVE-2026-2743 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-2743 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2743 exists.

Sources

Also known as GHSA-3hq3-ff7h-6mf5.