CVE-2026-108120: SME Server 11.0rc1-215

Affected technology

SME Server · 11.0rc1-215
koozali

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files. Vendor/CNA’s CVSS 4.0 assessment (base score 7.7/10) rates confidentiality impact as high; integrity and availability impact as none.