CVE-2026-104082: high-severity vulnerability in Smartertools Smartermail
SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
Published · Updated
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.6epss 0.6%
from disclosure to weapon3 days
Published on NVDOct 9
1st PoC+3d
exploitation probability
0.6%top 52% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Smartertools · Smartermailpublic PoCs found — 2
githubgithub.com/eev4n/smartermail★ 0cve_referenceblog.evan.lat/posts/sm/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Smartertools Smartermail
In the same product, most dangerous first.