CVE-2012-4940: Axigen Free Mail Server View Log Files path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read and delete with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing is present.

What it is

The View Log Files component in Axigen Free Mail Server has multiple directory traversal flaws. A remote attacker can supply a .. (dot dot) sequence in the fileName parameter to read or delete arbitrary files on the server. The flaw matters because it exposes file contents and allows destructive file deletion without any credentials.

Impact

An attacker can read arbitrary files on the host, potentially exposing configuration, credentials or mail data, and can delete arbitrary files, which may disrupt the mail service or destroy evidence.

Attack surface

Reachable over the network through HTTP requests to source/loggin/page_log_dwn_file.hsp and the default URI using download, edit or delete actions. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high at 0.836 (99.7th percentile), indicating strong predicted exploitation activity.

What to do

• Apply the vendor fix or upgrade Axigen Free Mail Server to a version that resolves the traversal issue; no fixed version is stated in this record, so confirm with the vendor.
• Restrict network access to the View Log Files component and the affected URIs to trusted administrative networks.
• Validate and canonicalize the fileName parameter, rejecting any path separators or .. sequences before file operations.
• Run the mail server with least privilege and isolate it so arbitrary file reads or deletes cannot reach sensitive system files.
• Monitor and back up log and configuration files so deletions can be detected and restored.

Detection

• Inspect web server and application logs for requests to page_log_dwn_file.hsp or the default URI containing .. or encoded traversal sequences in the fileName parameter.
• Alert on download, edit or delete actions against log files from unexpected source IPs or outside normal administrative hours.
• Monitor file system events for unexpected reads or deletions of files outside the log directory.
• Correlate repeated traversal attempts from a single source with subsequent file access anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.