MAILENABLE · CVE-2026-114556 · Other
FIX → 10.60 · 9.92 · 8.73 ✓ verified
MailEnable's Save method does not validate a user-supplied path before file operations, so a remote attacker can create arbitrary files on the server. Authentication is not required, and chained with other flaws the attacker can run code as SYSTEM.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted MailEnable mail servers on Windows running version 10.59 or earlier. MailEnable's bulletin places this CVE in the XMPP component, and ZDI says no login is needed. An attacker can create files anywhere the service can write, and combined with other flaws this can lead to code running as SYSTEM. Servers upgraded to the fixed versions are not affected.
Not affected if patched, xmpp-disabled
Who cares mail-server, mailenable, self-hosted, windows, xmpp
Upgrade to 10.60 · 9.92 · 8.73
Upgrade MailEnable: v10 to 10.60 or later, v9 to 9.92 or later, v8 to 8.73 or later (download.asp; older at downloadprevious.asp).
MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.