CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability

Medium severity, CVSS 4.9. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 51.7% chance of exploitation in the next 30 days.

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Affected products

• SonicWall Email Security: before 10.0.9.6173 (fixed in 10.0.9.6173)
• SonicWall Email Security Appliance 3300 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 4300 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 5000 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 5050 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 7000 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 7050 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 8300 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Appliance 9000 Firmware: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Email Security Virtual Appliance: before 10.0.9.6177 (fixed in 10.0.9.6177)
• SonicWall Hosted Email Security: before 10.0.9.6173 (fixed in 10.0.9.6173)

Published 2021-04-20. Last modified 2026-10-01.