PT-2026-94112
CVE-2026-92595
·
تاريخ النشر
2026-09-08
·
تاريخ التحديث
2026-09-19
الوصف من
CVSS 4.0
6.0
متوسطةالمقاييسAV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Nodemailer versions prior to 9.1.1
Description
The software fails to honor the
disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent() using the legacy three-argument signature resolveContent(data, key, callback). This occurs because shared.resolveContent() normalizes the missing options argument to an empty object, causing the resolveContentValue() function to skip access-control checks and reach nmfetch(url) or fs.createReadStream(path). Consequently, application or plugin code resolving untrusted content (such as html, text, attachment path, or href) can be manipulated to read arbitrary local files or perform server-side request forgery (SSRF), which is when an attacker induces a server to make requests to an unintended location, bypassing the enabled sandbox.Recommendations
Update to version 9.1.1.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾