{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics \nTechnologies). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header, \nX-SM_SAVE_BODY_4DEBUGGING, as an absolute file path and the message body as the file content, writing to any path on \nthe host with no validation, no allowlist, and no authentication gate. The SMTP service accepts unauthenticated \ndelivery by default (reqAuthForLocal=false is the global default). When Xeams runs as root, an attacker writes a cron \njob into /etc/cron.d/, which crond executes as root every minute, yielding a complete unauthenticated root RCE. The \nentire chain depends only on SMTP, requires no HTTP and no credentials, and was dynamically verified on both port 25 \nand port 587 producing uid=0(root).\n\nImpact: Arbitrary root command execution on the mail server host, full root read of the Xeams mail repository (all .eml \nenvelope/subject/body), and complete control of the Xeams process; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce\n\nVulnerability 2: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe built-in SQLRunner.jsp administrative page is directly reachable without authentication: web.xml declares no \nsecurity-constraint for JSPs, the SynaFilter maps only /FrontController/*, and NewPageHeader.jsp does not enforce \nauthentication. Directly requesting SQLRunner.jsp bypasses the FrontController dispatch, the SynaFilter, and the \noperation-level authorization. The operation=1 branch performs no auth check and connects to the embedded Derby \ndatabase using attacker-supplied credentials; Xeams hardcodes the Derby database-owner credentials system/manager, so \nan attacker reuses them. With the JDBC connection stored in the HTTP session, operation=2 issues arbitrary SQL, and \ncalling the Derby procedure SYSCS_UTIL.SYSCS_EXPORT_QUERY writes an attacker-controlled JSP webshell into the Tomcat \nwebapps/ROOT docBase. A subsequent GET triggers Jasper on-demand compilation and execution, yielding arbitrary command \nexecution at the Xeams process privilege (root in the default deployment). The chain requires only HTTP access to the \nXeams web port (default 5272/TCP), no valid login, no CSRF token, and no prior session. The RCE was dynamically \nverified end-to-end producing uid=0(root).\n\nImpact: Arbitrary command execution on the mail server host at the Xeams process privilege (root in the default \ndeployment), full read of the Xeams mail repository and the host filesystem, and complete control of the Xeams process \nand embedded Derby database.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/13"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0060",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13",
            "automated": true,
            "contentSha256": "0677fda4e29c7284466913132fa5d7f43fce586521bbff2ddab08fe54750a146",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0060"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}