Smartermail

SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.

Published: 2026-02-16T16:27:14.946Z
Updated: 2026-02-22T19:08:16.471Z

SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication.

Published: 2026-01-29T03:38:02.582Z
Updated: 2026-03-05T01:30:42.395Z

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Published: 2026-01-23T16:53:34.951Z
Updated: 2026-08-04T03:56:04.225Z

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

Published: 2026-01-22T14:35:17.235Z
Updated: 2026-08-04T03:56:03.047Z

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Published: 2025-12-29T02:15:58.200Z
Updated: 2026-02-26T16:07:23.398Z