ZDI-26-869: MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability
Published Nov 4, 2026
·Updated
This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.4. The following CVEs are assigned: CVE-2026-114556.
Event History
Nov 4, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Can this be exploited without valid MailEnable credentials?
Yes. Authentication is not required, so a remote unauthenticated attacker can exploit the vulnerability against affected MailEnable installations.
2
What is the potential impact of successful exploitation?
An attacker can create arbitrary files on an affected MailEnable installation.