Apache James: ManageSieve file implementation cross-user path traversal

Apache Software Foundation Apache James

A vulnerability in Apache James before 3.9.1 allows a logged-in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or traffic capture.

Do this now

Upgrade Apache James to 3.9.1.

Fix it

Upgrade to Apache James 3.9.1

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 17:18 UTC
Fixed in: 3.9.1
Identifiers: CVE-2026-76168
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache James: ManageSieve file implementation cross-user path traversal
Severity: unknown. Patch status: patched.
Affected: Apache Software Foundation Apache James
Fixed in: 3.9.1
Ids: CVE-2026-76168

A vulnerability in Apache James before 3.9.1 allows a logged-in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or traffic capture.

## Steps
1. Search the repo, its CI and infra config for Apache Software Foundation Apache James. If present, report the version in use and whether it's affected.
2. Fix by release line: Apache James: 3.9.1.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache James | fixed | 3.9.1 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-76168") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/550
https://pwned.coffee/i/apache-james-managesieve-file-implementation-cross-user-cve-2026-76168

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Apache James before 3.9.1 3.9.1 CVE record (CNA) checked 7 Nov
Score: No CVSS published yet: severity unknown.
Last checked: 7 Nov 2026, 18:18 UTC

Product	Affected	Fixed in	Source
Apache James	before 3.9.1	3.9.1	CVE record (CNA) checked 7 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: CVE-2026-76168: Apache James: ManageSieve file implementation cross-user path traversal

Follow on X

Totalone coffee