CVE-2021-40525: Sieve file storage vulnerable to path traversal attacks

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-04 · updated 2026-06-17
Weakness: CWE-22

Description

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Affected products

Apache Software Foundation Apache James: before 3.6.2 — fixed in 3.6.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache James 3.6.2. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2022/01/04/4
http://www.openwall.com/lists/oss-security/2022/02/07/1
https://www.openwall.com/lists/oss-security/2022/01/04/4
http://www.openwall.com/lists/oss-security/2022/01/04/4
http://www.openwall.com/lists/oss-security/2022/02/07/1
https://www.openwall.com/lists/oss-security/2022/01/04/4

Get alerted when CVE-2021-40525 or the next vulnerability affects your stack