CVE-2026-108120

{
  "etk_id": "ETK-2026-2035",
  "cve_id": "CVE-2026-108120",
  "display_id": "CVE-2026-108120",
  "ghsa_id": "GHSA-wj5h-2j88-93vj",
  "euvd_id": "EUVD-2026-104070",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Koozali SME Server View Logs",
  "summary": "Koozali SME Server 11.0rc1-215 is affected by a path traversal issue in its View Logs functionality. An unauthenticated attacker who can reach that functionality may read files outside the intended log directory, including sensitive system or application files.",
  "mitigation": "Restrict access to the View Logs functionality to trusted administrators and networks immediately, and remove public access where possible. Apply an upstream update when Koozali publishes a release addressing this issue.",
  "vendor": "koozali",
  "product": "SME Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "11.0rc1-215"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "SME Server",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber",
  "epss_score": 0.0037,
  "epss_percentile": 0.2922,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 88.64253643333333,
  "t0_at": "2026-10-19T05:12:00.139000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T05:12:00.139000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T05:12:00.139000+00:00",
      "url": "https://github.com/advisories/GHSA-wj5h-2j88-93vj"
    }
  }
}