CVE-2024-3195 is a medium severity (CVSS 4.7) path traversal flaw in the Admin Endpoints of MailCleaner, in versions up to 2023.03.14. The record says it can be initiated remotely and recommends a patch. The fixed version was not confirmed, so check the project advisory.
What's affected
MailCleaner up to 2023.03.14. The record references GitHub pull request 601 and modzero advisory MZ-24-01, released April 29, 2024, and says an exploit has been disclosed publicly.
The attack complexity in the vector is high and privileges are required, which explains the medium score. We did not confirm a fixed release number from the pages we reviewed.
The weakness class: CWE-22, path traversal. The NVD record scores it 4.7 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description text says classified as critical (VulDB wording), while NVD scores this 4.7, Medium. Both are published.
How to check if you're exposed
Check your MailCleaner version against 2023.03.14. Then confirm who can reach the admin endpoints and whether they are exposed beyond a management network.
What to do now
- Review the pull request and advisory, then upgrade to a release that contains the fix.
- Restrict the admin interface by network and by account.
- Check file permissions for the service account so it cannot read or write beyond what it needs.
- Apply the fixes for the other three MailCleaner CVEs together.
Why it matters
Path traversal, CWE-22, means a file path built from user input can point outside the intended folder. What an attacker can reach depends on file permissions for the service account, so least privilege on the host limits the damage.
The record lists the CWE twice, which is a data quirk. A medium score here should not delay the patch, since it ships in the same update as the command injection fixes.
Quick check
Which of the four MailCleaner CVEs should I patch first?
They are fixed in the same upstream change, so patch them together. If you must prioritize mitigation, restrict the admin interface first and treat CVE-2024-3191 (9.8) as the most urgent.
Sources
- modzero advisory MZ-24-01
- References in the NVD record (not individually reviewed): GitHub pull request 601 for MailCleaner and VulDB entry 262311
- Safeguard Gold entry for CVE-2024-3195
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
