CVE-2006-0448: Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service

This month

HIGH 7.5DOWNGRADEDOWNGRADE

CVE-2006-0448 is a high-severity flaw (CVSS 7.5) affecting mail server, spa-pro mail atsolomon. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.

Why this priority

High severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
EPSS exploit chance	2.1% (top 18%)
CISA exploited list	No
Published	2006-01-27
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: e-post corporation

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-01-27 00:03 UTCPublished CVE record published
2026-06-16 22:20 UTCUpdated Record last modified

e-post corporation mail server DOWNGRADE

Affected: 4.05

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.05

1. Check installed version

apt-cache policy mail-server || rpm -q mail-server || mail-server --version

2. No fixed release: DOWNGRADE to a release before 4.05 (Debian / Ubuntu)

apt-cache madison mail-server sudo apt install mail-server=<VERSION_BEFORE_4.05> sudo apt-mark hold mail-server

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mail-server sudo dnf downgrade mail-server-<VERSION_BEFORE_4.05> sudo dnf versionlock add mail-server

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

e-post corporation spa-pro mail atsolomon DOWNGRADE

Affected: 4.05

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.05

1. Check installed version

apt-cache policy spa-pro-mail-atsolomon || rpm -q spa-pro-mail-atsolomon || spa-pro-mail-atsolomon --version

2. No fixed release: DOWNGRADE to a release before 4.05 (Debian / Ubuntu)

apt-cache madison spa-pro-mail-atsolomon sudo apt install spa-pro-mail-atsolomon=<VERSION_BEFORE_4.05> sudo apt-mark hold spa-pro-mail-atsolomon

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list spa-pro-mail-atsolomon sudo dnf downgrade spa-pro-mail-atsolomon-<VERSION_BEFORE_4.05> sudo dnf versionlock add spa-pro-mail-atsolomon

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-0448?

mail server: downgrade or apply the listed mitigation; spa-pro mail atsolomon: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-0448 being exploited?

CVE-2006-0448 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-0448 affect?

CVE-2006-0448 affects mail server, spa-pro mail atsolomon. Severity is high (CVSS 7.5). Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service vi

How urgent is CVE-2006-0448?

Priority 47/100. High severity

Related CVEs

CVE-2025-2848 MEDIUM 6.3 UPGRADE A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive
CVE-2021-36580 MEDIUM 6.1 UPGRADE UPGRADE Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via
CVE-2025-40632 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0
CVE-2025-40631 MEDIUM 6.1 DOWNGRADE HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0
CVE-2025-40630 MEDIUM 6.1 DOWNGRADE Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0

References

← Back to latest CVEs