{"id":"CVE-2026-114556","kind":"vulnerability","aliases":["CVE-2026-114556"],"related":[],"title":"MailEnable: directory traversal lets remote attackers create arbitrary files","description":"MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161.","summary":"MailEnable's Save method does not validate a user-supplied path before file operations, so a remote attacker can create arbitrary files on the server. Authentication is not required, and chained with other flaws the attacker can run code as SYSTEM.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MailEnable","fixed":["10.60","9.92","8.73"],"affected":"<= 10.59 (v10); < 9.92 (v9); < 8.73 (v8)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["mail-server","mailenable","other","self-hosted","windows","xmpp"],"not_affected_if":["patched","xmpp-disabled"],"how_to_check":"Check the installed MailEnable version in the MailEnable Administration program or the Windows installed-programs list. Exposed if it is 10.59 or earlier (v10), below 9.92 (v9) or below 8.73 (v8), and the XMPP service is running and reachable.","fix":"Upgrade MailEnable: v10 to 10.60 or later, v9 to 9.92 or later, v8 to 8.73 or later (download.asp; older at downloadprevious.asp).","status":"open","published_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","triaged_at":"2026-11-12T03:47:47+00:00","updated_at":"2026-11-12T03:54:10+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-12T03:47:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MailEnable: directory traversal lets remote attackers create arbitrary files","impact":"high","summary":"MailEnable's Save method does not validate a user-supplied path before file operations, so a remote attacker can create arbitrary files on the server. Authentication is not required, and chained with other flaws the attacker can run code as SYSTEM.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mailenable","windows","mail-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker creates arbitrary files and may chain to SYSTEM code execution.","analyst_note":"Find affected and fixed MailEnable versions and vendor advisory via the ZDI advisory for ZDI-CAN-29161 and MailEnable's site; NVD link is https://nvd.nist.gov/vuln/detail/CVE-2026-114556.","how_to_check":"- unknown","plain_action":"","product_name":"MailEnable","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any organization running MailEnable mail server installations is potentially exposed, since the flaw is reachable remotely without authentication. The sources do not list affected or fixed versions, so the exact range is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4630,"output_tokens":506,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed MailEnable versions and vendor advisory via the ZDI advisory for ZDI-CAN-29161 and MailEnable's site; NVD link is https://nvd.nist.gov/vuln/detail/CVE-2026-114556.","search":"'-114556':12A,15A '-2026':11A,14A '29161':154C 'affect':87C 'allow':79C 'arbitrari':8A,48B,73C,84C 'attack':6A,45B,63B,81C,133C 'authent':53B,91C 'chain':58B 'code':66B,144C 'conjunct':138C 'context':147C 'creat':7A,47B,83C 'creation':75C 'cve':10A,13A 'directori':2A,71C 'execut':143C 'exist':102C 'exploit':96C 'file':9A,40B,49B,74C,85C,130C 'flaw':61B,101C 'host':24B 'implement':105C 'instal':88C 'issu':111C 'lack':115C 'let':4A 'leverag':135C 'mail':18B 'mail-serv':17B 'mailen':1A,20B,27B,69C,90C 'mailenable':16A 'method':30B,109C 'oper':41B,131C 'path':38B,124C 'prior':125C 'proper':117C 'remot':5A,44B,80C 'requir':56B,94C 'result':112C 'run':65B 'save':29B,70C,108C 'self':23B 'self-host':22B 'server':19B,52B 'specif':100C 'suppli':37B,123C 'system':68B,149C 'travers':3A,72C 'use':127C 'user':36B,122C 'user-suppli':35B,121C 'valid':33B,118C 'vulner':76C,78C,98C,141C 'window':25B 'within':103C 'xmpp':26B 'zdi':152C 'zdi-can':151C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MailEnable mail servers on Windows running version 10.59 or earlier. MailEnable's bulletin places this CVE in the XMPP component, and ZDI says no login is needed. An attacker can create files anywhere the service can write, and combined with other flaws this can lead to code running as SYSTEM. Servers upgraded to the fixed versions are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-12T03:54:10Z","by":"analyst","doc":"https://www.mailenable.com/rss/article.asp?ID=SECURITY1060","run_id":3701},"products":{"at":"2026-11-12T03:54:10Z","by":"analyst","doc":"https://www.mailenable.com/rss/article.asp?ID=SECURITY1060","run_id":3701},"who_affected":{"at":"2026-11-12T03:54:10Z","by":"analyst","doc":"https://www.mailenable.com/rss/article.asp?ID=SECURITY1060","run_id":3701}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mailenable"],"ptokens":["mailenable"],"labels":["high","mailenable","mailserver","other","selfhosted","vendor","windows","xmpp"],"campaign_type":null,"search_a":"'-114556':12A,15A '-2026':11A,14A 'arbitrari':8A 'attack':6A 'creat':7A 'cve':10A,13A 'directori':2A 'file':9A 'let':4A 'mailen':1A 'mailenable':16A 'remot':5A 'travers':3A","search_b":"'arbitrari':48B 'attack':45B,63B 'authent':53B 'chain':58B 'code':66B 'creat':47B 'file':40B,49B 'flaw':61B 'host':24B 'mail':18B 'mail-serv':17B 'mailen':20B,27B 'method':30B 'oper':41B 'path':38B 'remot':44B 'requir':56B 'run':65B 'save':29B 'self':23B 'self-host':22B 'server':19B,52B 'suppli':37B 'system':68B 'user':36B 'user-suppli':35B 'valid':33B 'window':25B 'xmpp':26B","search_c":"'29161':154C 'affect':87C 'allow':79C 'arbitrari':73C,84C 'attack':81C,133C 'authent':91C 'code':144C 'conjunct':138C 'context':147C 'creat':83C 'creation':75C 'directori':71C 'execut':143C 'exist':102C 'exploit':96C 'file':74C,85C,130C 'flaw':101C 'implement':105C 'instal':88C 'issu':111C 'lack':115C 'leverag':135C 'mailen':69C,90C 'method':109C 'oper':131C 'path':124C 'prior':125C 'proper':117C 'remot':80C 'requir':94C 'result':112C 'save':70C,108C 'specif':100C 'suppli':123C 'system':149C 'travers':72C 'use':127C 'user':122C 'user-suppli':121C 'valid':118C 'vulner':76C,78C,98C,141C 'within':103C 'zdi':152C 'zdi-can':151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114556","severity":null,"published_at":"2026-11-12T03:17:08+00:00","modified_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","fetched_at":"2026-11-12T03:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114556:3701","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-869/","severity":null,"published_at":"2026-11-12T03:54:10+00:00","modified_at":"2026-11-12T03:54:10+00:00","first_seen_at":"2026-11-12T03:54:10+00:00","fetched_at":"2026-11-12T03:54:10+00:00","note":"ZDI-26-869 and MailEnable's own bulletin (SECURITY1060): fixed in 10.60/9.92/8.73; vendor ties this CVE to XMPP. No exploitation or PoC seen; social search skipped.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-869/","https://www.mailenable.com/rss/article.asp?ID=SECURITY1060"]}],"documents":[{"id":131570,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-869/","title":"ZDI-26-869 MailEnable Save Directory Traversal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131572,"url":"https://www.mailenable.com/rss/article.asp?ID=SECURITY1060","title":"MailEnable Vulnerability Update (10.60 / 9.92 / 8.73)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}