CVE-2026-104082 SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
A SysAdmin can achieve remote code execution with SYSTEM privileges by bypassing volume mount controls to upload and execute malicious scripts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104082?
CVE-2026-104082 is a high-severity code injection vulnerability in Smartertools Smartermail, published on 9 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Weakness: CWE-94
Which versions are affected by CVE-2026-104082?
How do I fix CVE-2026-104082?
No fix has been published for CVE-2026-104082 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-104082 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104082 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-4rp5-r82m-g6p3.