Arbitrary File Creation Vulnerability in MailEnable by MailEnable
CVE-2026-114556

7.4HIGH

Key Information:

Vendor

Mailenable

Status
Mailenable
Vendor
CVE Published:
12 November 2026

What is CVE-2026-114556?

The vulnerability in MailEnable's Save method allows remote attackers to exploit a flaw in the validation of user-supplied paths. This oversight can enable attackers to create arbitrary files on the server without the need for authentication. Successful exploitation may further facilitate escalated privileges and arbitrary code execution within the context of the SYSTEM account. This vulnerability highlights the importance of robust validation mechanisms in software design.

Affected Version(s)

MailEnable 10.59

References

https://www.zerodayinitiative.com/advisories/ZDI-26-869/
x_research-advisory

CVSS V3.0

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.