CVE-2026-108121

MediumCVSS 6.9

Published: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

A vulnerability in the domain creation functionality of SME Server 11.0rc1-215 allows an attacker with high privileges to inject reserved Apache configuration directives. This corrupts httpd.conf and prevents Apache from starting after a reboot, causing a denial-of-service (DoS) condition affecting the web server and hosted virtual hosts.

Risk Assessment

A high-privileged attacker can permanently corrupt the Apache configuration, making all hosted sites unavailable after a server reboot. This can disrupt business operations and require manual administrative intervention.

Recommendation

Restrict domain creation privileges to trusted administrators only and apply the vendor patch when available. Regularly back up the Apache configuration to enable quick service restoration.

Other vulnerabilities in SME Server

CVE-2026-108120High
A path traversal vulnerability exists in the View Logs functionality of koozali's SME Server version 11.0rc1-215. An unauthenticated attacker can access files outside the intended directory, leading to exfiltration of potentially sensitive system and application files.

Original NVD description (English source)

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS