CVE-2026-104082: SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SmarterMailto a version that resolves this vulnerability.Fixed in 9777
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a SysAdmin-scoped access token. The attack is remotely reachable and does not require user interaction, but it is not an unauthenticated vulnerability.
Which deployments are affected?
SmarterMail builds before 9777 are affected. The described exploitation relies on the Volume Mount functionality, domain creation through the domain-put endpoint, global mail settings, and the mail file-storage upload API.
What access does successful exploitation provide?
A successful attacker can execute a malicious script as the SmarterMail service account. The described outcome is a reverse shell with SYSTEM-level privileges.
How can I determine whether an instance may have been targeted?
Review for new or modified mail domains whose FileStore root paths point into the trusted Scripts directory, changes to the upload extension blacklist, and newly created or changed CommandMount configurations. Also investigate unexpected script uploads through the mail file-storage upload API and suspicious processes or outbound connections from the SmarterMail service account.
What should be prioritized if immediate remediation is not possible?
Restrict and review SysAdmin-scoped access tokens, since they are required for exploitation. Monitor or limit access to the affected domain, mount, global-mail, and file-storage upload operations, and review existing mount and domain configurations for the described path placement.