ZDI-CAN-29161: ZDI-26-869: MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability
Published Nov 4, 2026
·Updated
This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.4. The following CVEs are assigned: CVE-2026-114556.
Event History
Nov 4, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker can exploit it without authentication. Any affected MailEnable installation reachable by the attacker is therefore exposed.
2
What level of access does exploitation provide?
Successful exploitation allows the attacker to create arbitrary files on the affected installation.
3
What identifier should be used to track this vulnerability?
The assigned CVE is CVE-2026-114556. ZDI rates the issue at CVSS 7.4.