Not rated
CVE-2021-40525 Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
Description
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache James 3.6 | earliest → 3.6.0 | No fix stated |
References
- www.openwall.com www.openwall.com
- [oss-security] 20220104 CVE-2021-40525: Apache James: Sieve file storage vulnerable to path traversal attacks www.openwall.com
- [oss-security] 20220207 CVE-2022-22931: Path traversal in Apache James www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache James
The 13 CVEs of Apache James →
CVE-2026-85111
Apache James: Denial of service upon MIME parsing
8.7
High
CVE-2026-76168
Apache James: ManageSieve file implementation cross-user path traversal
Not rated
CVE-2026-74756
Apache James: WebAdmin exposed without authentication on official Docker default
Not rated
CVE-2026-76171
Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
Not rated