CVE-2021-40525: Path Traversal in Apache James
Summary
CVE-2021-40525: Path traversal in Apache James. Affects org.apache.james:james-server versions < 3.6.1. Fixed in 3.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache James is an open-source email server that provides a complete implementation of the SMTP, POP3, and IMAP protocols. It offers various features for managing and organizing email messages. The ManagedSieve component in Apache James is responsible for handling Sieve scripts, which are used for email filtering and processing. The file storage mechanism used for storing these scripts is vulnerable to path traversal, allowing an attacker to read and write arbitrary files on the server. This vulnerability has been assigned the CVE identifier CVE-2021-40525.
Vulnerability Detail
The path traversal vulnerability in Apache James allows an attacker to bypass the intended file access restrictions and access files outside the designated directory. By manipulating the file path in the request, an attacker can read sensitive files containing confidential information or modify critical system files, leading to unauthorized access, data leakage, or even remote code execution. This vulnerability has a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Latest published version: 3.9.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement access controls at the operating system level to restrict the permissions of the Apache James process. By configuring appropriate file system permissions, it is possible to limit the impact of a potential path traversal attack. However, this workaround is not a comprehensive solution and should be considered temporary until the upgrade to a patched version can be performed.
Conclusion
The path traversal vulnerability in Apache James can be mitigated by upgrading to the latest patched version. It is crucial to promptly apply the necessary updates to ensure the security and integrity of the email server. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.james:james-server →
FAQ
Apache James is an open-source email server that provides SMTP, POP3, and IMAP functionality.
A path traversal vulnerability allows an attacker to access files outside the intended directory by manipulating file paths in requests.
This vulnerability allows an attacker to read and write arbitrary files on the server, potentially leading to unauthorized access, data leakage, or remote code execution.
To fix this vulnerability, upgrade to Apache James version 3.6.1 or higher.
As a temporary workaround, implement access controls at the operating system level to restrict Apache James' permissions.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.james:james-server.
