CVE-2026-104082High· 7.2▾ TwilightSmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11905Medium· 6.3A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-14730Medium· 4.7A security flaw has been discovered in CTCMS Content Management System up to 2.1.2
CVE-2025-14729Medium· 4.7A vulnerability was identified in CTCMS Content Management System up to 2.1.2
CVE-2025-15148Medium· 4.7A flaw has been found in CmsEasy up to 7.7.7
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0
CVE-2025-15394Medium· 4.7A vulnerability was detected in iCMS up to 8.0.0