CVE-2026-104082 in SmarterMail
Summary
by MITRE • 10/09/2026
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in versions of SmarterMail prior to build 9777 represents a critical remote code execution flaw rooted in improper access control and insufficient input validation within the application's domain provisioning and file storage mechanisms. The core issue stems from the ability of an attacker possessing a SysAdmin-scoped access token to manipulate the Volume Mount configuration, specifically by bypassing script-directory containment controls. This is achieved through the provision of a new mail domain that utilizes an arbitrary FileStore root path located within the trusted Scripts directory. By exploiting the domain-put endpoint, the adversary can effectively redirect file storage operations into areas of the system where executable scripts are permitted to run without adequate restriction, thereby undermining the security boundary intended to isolate script execution from general data storage.
The exploitation chain begins with reconnaissance and privilege escalation steps that leverage specific API endpoints to gather necessary information and disable protective measures. The attacker first utilizes the AddOrUpdateMount endpoint to disclose the internal path of the Scripts directory, establishing a precise target for subsequent actions. Following this disclosure, the adversary interacts with the global-mail endpoint to clear the upload extension blacklist. This step is crucial as it removes restrictions on file types that can be uploaded through the system's standard mail file-storage API. By eliminating these constraints, the attacker ensures that malicious files are accepted by the server without triggering immediate rejection based on their extensions or content signatures.
Once the environment is prepared and protective filters are disabled, the attacker uploads a malicious script via the ordinary mail file-storage upload API. The critical failure occurs when saving a CommandMount triggers the RunScript function before proper validation checks can be performed. This race condition or logic error allows the execution of arbitrary code with the privileges of the SmarterMail service account. Given that this service typically operates with SYSTEM-level privileges on Windows environments, the successful exploitation results in full system compromise. The attacker gains a reverse shell as the local System user, enabling complete control over the underlying operating system and all data hosted by the mail server.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, specifically regarding the misuse of administrative privileges to bypass security controls. Furthermore, it relates to CWE-434, Unrestricted Upload of File with Dangerous Type, as the attacker exploits the ability to upload executable scripts by disabling extension blacklists. From a tactical perspective, this attack vector maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code and T1078 Valid Accounts for leveraging legitimate credentials. The scenario also reflects aspects of T1505 Server Software Component, where the attacker abuses server-side components like scripts and modules to maintain persistence or execute commands.
Mitigation strategies must prioritize immediate patching to version 9777 or later, which addresses these logic flaws in the domain provisioning and script execution workflows. In addition to updating software, administrators should enforce strict least-privilege principles for service accounts, ensuring that the SmarterMail process does not run with SYSTEM-level privileges unless absolutely necessary. Network segmentation can also limit lateral movement if a compromise occurs, while rigorous monitoring of API calls involving volume mounts and file uploads can help detect anomalous behavior indicative of exploitation attempts. Regular audits of upload filters and script execution policies are essential to prevent similar bypasses in future updates or configurations.