← Vulnerability feed

Vulnerability record · CVE-2005-1105 · published 2 May 2005

CVE-2005-1105: Sun javamail vulnerability

Sun · Javamail

Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the Content-Disposition header.

5.0 CVSS 2.0 Medium EPSS 5.8% · top 7.1%
5.0CVSS 2.0 base score
5.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
16 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the Content-Disposition header.

AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=bugtraq&m=111335615600839&w=2
http://marc.info/?l=bugtraq&m=111335615600839&w=2

Track CVE-2005-1105 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.0CVE-2007-6059Sun javamail vulnerabilityJavamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the do…EPSS 1.8%5.0CVE-2005-1753Sun javamail permissions and access controls vulnerabilityReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments v…EPSS 1.2%5.0CVE-2005-1754Apache tomcat information exposure vulnerabilityJavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument …EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2005-1105), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.