CVE-2026-95588 in SMTP Newsletter Plugin
Summary
by MITRE • 10/01/2026
Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an unauthenticated arbitrary file deletion flaw within AcyMailing SMTP Newsletter versions prior to or equal to 11.0.5 represents a critical security deficiency that compromises the integrity of the underlying web server infrastructure. This component, widely deployed in Joomla-based websites for managing email marketing campaigns and newsletter distributions, exposes a severe attack vector due to insufficient input validation on file path parameters. The core technical flaw stems from the application's failure to properly sanitize user-supplied data before utilizing it in filesystem operations. Specifically, when handling requests related to SMTP configuration or template management, the software accepts arbitrary paths without verifying their legitimacy against an allowlist of expected directories. This lack of strict boundary enforcement allows an attacker to manipulate file system traversal sequences, commonly known as directory traversal attacks, to target files outside the intended application scope.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code (Code Injection), specifically in the context of file system manipulation. The absence of authentication requirements for these specific endpoints significantly lowers the barrier to entry for malicious actors, enabling remote unauthenticated exploitation over the network. An attacker can craft HTTP requests containing carefully constructed path strings that escape the web root directory. By leveraging standard operating system conventions such as dot-dot-slash sequences or absolute paths depending on the server environment, the vulnerable function executes a deletion command targeting critical system files, configuration backups, or sensitive data stores located in parent directories relative to the application installation.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on Joomla CMS environments running affected versions of AcyMailing SMTP Newsletter. The ability to delete arbitrary files means that an attacker can remove essential components required for website functionality, leading to a complete denial of service condition where the web application becomes inaccessible or exhibits erratic behavior due to missing dependencies. Furthermore, if critical configuration files containing database credentials, API keys, or administrative session tokens are deleted, it may trigger security mechanisms that lock out legitimate administrators while simultaneously exposing sensitive data through error messages or fallback states. In more complex attack chains, this file deletion capability can serve as a precursor to further exploitation, such as deleting log files to cover tracks of other malicious activities like web shell uploads or database exfiltration attempts.
This vulnerability aligns with the MITRE ATT&CK framework technique T1070: Indicator Removal on Host, specifically under sub-techniques related to clearing logs and removing artifacts, although its primary classification is more accurately mapped to T1485: Data Destruction. The lack of authentication makes this a high-risk issue for public-facing websites, as automated scanning tools can easily detect and exploit the flaw without requiring any prior access or credentials. Attackers often target such vulnerabilities in bulk campaigns to disrupt business operations or create leverage for ransomware attacks by destroying backup files before encrypting remaining data.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade AcyMailing SMTP Newsletter to a version strictly greater than 11.0.5, where the developers have implemented proper input validation and path canonicalization checks to prevent directory traversal attacks. Until an update is applied, temporary mitigations include restricting access to vulnerable endpoints via web application firewall rules that block requests containing suspicious file path patterns such as ../ or absolute paths outside the allowed base directories. Additionally, implementing strict file permission settings on the server side can limit the damage by ensuring that even if a deletion attempt succeeds, it does not affect critical system files owned by other users with higher privileges. Regular auditing of application logs for unusual HTTP requests targeting file management endpoints is also recommended to detect potential exploitation attempts early in the kill chain.