PT-2026-99394 · Unknown · Acymailing Enterprise
CVE-2026-94132
·
Published
2026-09-26
·
Updated
2026-09-29
CVSS v4.0
9.5
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
AcyMailing Enterprise versions prior to 11.1.0
Description
A remote code execution issue exists in the mailbox action feature. The system saves MIME parts of incoming emails to the
media/com acym/upload/ directory without performing extension checks. This allows an attacker to send a specially crafted email to the monitored mailbox to write a PHP file into the web root, potentially leading to arbitrary code execution.Recommendations
Update AcyMailing Enterprise to version 11.1.0 or later.
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Acymailing Enterprise