CVE-2016-1000282: Haraka Project Haraka

Critical severity, CVSS 9.8. EPSS: 13.5% chance of exploitation in the next 30 days.

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

Affected products

• Haraka Project Haraka: up to and including 2.8.8

Published 2019-02-05. Last modified 2026-06-17.