IceWarp Collaboration Server Vulnerable to Unauthenticated Directory Traversal (CVE‑2026‑2493)

LiveThreat Vulnerability Brief — CVE‑2026‑2493

What It Is — IceWarp’s collaboration server suffers a remote, unauthenticated directory‑traversal flaw that lets an attacker read arbitrary files on the host with root privileges. The issue stems from improper validation of the ticket parameter in the collaboration endpoint. Exploitability — No public PoC has been released, but the vulnerability is trivial to trigger (CVSS 7.5 / AV:N/AC:L/PR:N/UI:N).

Affected Products — IceWarp Collaboration Server (all versions prior to 14.2.0.12 and 14.1.0.20).

TPRM Impact — Organizations that rely on IceWarp for email or team collaboration may inadvertently expose internal configuration files, credentials, or proprietary data to a remote adversary, creating a downstream supply‑chain risk for partners and customers.

Recommended Actions —

1. Verify the deployed IceWarp version immediately.
2. Patch to 14.2.0.12, 14.1.0.20, or any later release.
3. If patching cannot be performed instantly, block the vulnerable endpoint with a WAF rule that validates the ticket parameter.
4. Enable file‑integrity monitoring and review server logs for anomalous ticket requests.
5. Conduct a risk assessment to determine whether any sensitive files may have been accessed.

Source: Zero Day Initiative Advisory – ZDI‑26‑130