https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 03:24:41 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-104082 <p>SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.</p> <p>SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.</p> https://db.gcve.eu/vuln/fkie_cve-2026-104082 https://db.gcve.eu/vuln/gcve-1988-2026-0493 <p><strong>Affected:</strong> unknown SmarterMail &lt;9777 Pre-Auth</p> <p>original blog: https://blog.evan.lat/posts/sm/</p> <p>SUMMARY: multiple vulns and misconfigurations in smartermail, notably a mxss and session persistence issues, alongside several logic bugs can be chained to achieve remote code execution as nt authority\system; https://nvd.nist.gov/vuln/detail/CVE-2026-104082 https://nvd.nist.gov/vuln/detail/CVE-2026-104083 https://nvd.nist.gov/vuln/detail/CVE-2026-104084</p> <p>a mutated xss exists in smartermail. by sending a specific text/calendar (icalendar) mimetype with the x-alt-desc header set to a mutated xss payload: &lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;&lt;style&gt;&lt;img src=x onerror=&#34;{js}&#34;&gt;&lt;/style&gt;</p> <p>the parser in the handrolled sanitizer of smartermail fails to properly sanitize this. the payload reforms after attempts at parsing it, allowing us to circumvent pre-auth with just one viewing of an email. notably, this can be done entirely without clicking as well (technically), since smartermail seems to open to latest email automatically</p> <p>====================</p> <p>a session logic vuln exists in smartermail. getting the refresh token of a domain admin before they are subsequently demoted does not actually invalidate any of the tokens privileges; meaning you can replay the token and continue retaining domain admin/sysadmin even after being demoted by simply posting the refresh token to /api/v1/auth/refresh-token and getting new accesstoken/refreshtoken pairs with the same roles</p> <p>====================</p> <p>a series of logic vulns exist in smartermail that can lead to rce a…</p> <p><strong>Affected:</strong> unknown SmarterMail &lt;9777 Pre-Auth</p> <p>original blog: https://blog.evan.lat/posts/sm/</p> <p>SUMMARY: multiple vulns and misconfigurations in smartermail, notably a mxss and session persistence issues, alongside several logic bugs can be chained to achieve remote code execution as nt authority\system; https://nvd.nist.gov/vuln/detail/CVE-2026-104082 https://nvd.nist.gov/vuln/detail/CVE-2026-104083 https://nvd.nist.gov/vuln/detail/CVE-2026-104084</p> <p>a mutated xss exists in smartermail. by sending a specific text/calendar (icalendar) mimetype with the x-alt-desc header set to a mutated xss payload: &lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;&lt;style&gt;&lt;img src=x onerror=&#34;{js}&#34;&gt;&lt;/style&gt;</p> <p>the parser in the handrolled sanitizer of smartermail fails to properly sanitize this. the payload reforms after attempts at parsing it, allowing us to circumvent pre-auth with just one viewing of an email. notably, this can be done entirely without clicking as well (technically), since smartermail seems to open to latest email automatically</p> <p>====================</p> <p>a session logic vuln exists in smartermail. getting the refresh token of a domain admin before they are subsequently demoted does not actually invalidate any of the tokens privileges; meaning you can replay the token and continue retaining domain admin/sysadmin even after being demoted by simply posting the refresh token to /api/v1/auth/refresh-token and getting new accesstoken/refreshtoken pairs with the same roles</p> <p>====================</p> <p>a series of logic vulns exist in smartermail that can lead to rce a…</p> https://db.gcve.eu/vuln/gcve-1988-2026-0493 https://db.gcve.eu/vuln/ghsa-4rp5-r82m-g6p3 <p>SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.</p> <p>SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.</p> https://db.gcve.eu/vuln/ghsa-4rp5-r82m-g6p3