CVE-2026-104082

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777

Description A remote code execution issue exists where an attacker with a SysAdmin-scoped access token can bypass Volume Mount script-directory containment. This is achieved by provisioning a new mail domain with an arbitrary FileStore root path within the trusted Scripts directory using the 'domain-put' endpoint. The attacker can identify the Scripts path via the 'AddOrUpdateMount' endpoint and clear the upload extension blacklist through the 'global-mail' endpoint. Subsequently, a malicious script can be uploaded via the mail file-storage upload API. When saving a CommandMount, the RunScript() function is triggered before validation, allowing a reverse shell to execute with SYSTEM-level privileges under the SmarterMail service account.

Recommendations Update SmarterMail to build 9777 or later.