---
id: "CVE-2026-114556"
page: "https://infrastack.ai/live/CVE-2026-114556"
kind: "vulnerability"
aliases: ["CVE-2026-114556"]
title: "MailEnable: directory traversal lets remote attackers create arbitrary files"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "MailEnable", "fixed": ["10.60", "9.92", "8.73"], "affected": "<= 10.59 (v10); < 9.92 (v9); < 8.73 (v8)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["mail-server", "mailenable", "other", "self-hosted", "windows", "xmpp"]
not_affected_if: ["patched", "xmpp-disabled"]
published_at: "2026-11-12T03:17:08+00:00"
first_seen_at: "2026-11-12T03:46:11+00:00"
updated_at: "2026-11-12T03:54:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114556", "first_seen_at": "2026-11-12T03:46:11+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-869/", "first_seen_at": "2026-11-12T03:54:10+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-869/", "https://www.mailenable.com/rss/article.asp?ID=SECURITY1060"]}]
exploit_sources: []
---

# MailEnable: directory traversal lets remote attackers create arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-114556 (this .md is for agents)

MailEnable's Save method does not validate a user-supplied path before file operations, so a remote attacker can create arbitrary files on the server. Authentication is not required, and chained with other flaws the attacker can run code as SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MailEnable affected <= 10.59 (v10); < 9.92 (v9); < 8.73 (v8) fixed 10.60, 9.92, 8.73

## How to check

Check the installed MailEnable version in the MailEnable Administration program or the Windows installed-programs list. Exposed if it is 10.59 or earlier (v10), below 9.92 (v9) or below 8.73 (v8), and the XMPP service is running and reachable.

## Fix

Upgrade MailEnable: v10 to 10.60 or later, v9 to 9.92 or later, v8 to 8.73 or later (download.asp; older at downloadprevious.asp).

## Timeline

- 2026-11-12T03:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114556
- 2026-11-12T03:54:10+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-869/ — ZDI-26-869 and MailEnable's own bulletin (SECURITY1060): fixed in 10.60/9.92/8.73; vendor ties this CVE to XMPP. No exploitation or PoC seen; social search skipped.

## Documents

- [advisory] ZDI-26-869 MailEnable Save Directory Traversal https://www.zerodayinitiative.com/advisories/ZDI-26-869/
- [fix] MailEnable Vulnerability Update (10.60 / 9.92 / 8.73) https://www.mailenable.com/rss/article.asp?ID=SECURITY1060

## From the sources

MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_