SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.

Affected: unknown SmarterMail <9777 Pre-Auth

original blog: https://blog.evan.lat/posts/sm/

SUMMARY: multiple vulns and misconfigurations in smartermail, notably a mxss and session persistence issues, alongside several logic bugs can be chained to achieve remote code execution as nt authority\system; https://nvd.nist.gov/vuln/detail/CVE-2026-104082 https://nvd.nist.gov/vuln/detail/CVE-2026-104083 https://nvd.nist.gov/vuln/detail/CVE-2026-104084

a mutated xss exists in smartermail. by sending a specific text/calendar (icalendar) mimetype with the x-alt-desc header set to a mutated xss payload: <math><mtext><mglyph><style><img src=x onerror="{js}"></style>

the parser in the handrolled sanitizer of smartermail fails to properly sanitize this. the payload reforms after attempts at parsing it, allowing us to circumvent pre-auth with just one viewing of an email. notably, this can be done entirely without clicking as well (technically), since smartermail seems to open to latest email automatically

====================

a session logic vuln exists in smartermail. getting the refresh token of a domain admin before they are subsequently demoted does not actually invalidate any of the tokens privileges; meaning you can replay the token and continue retaining domain admin/sysadmin even after being demoted by simply posting the refresh token to /api/v1/auth/refresh-token and getting new accesstoken/refreshtoken pairs with the same roles

====================

a series of logic vulns exist in smartermail that can lead to rce a…

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.