CVE-2026-104082: Improper Control of Generation of Code ('Code Injection') in Smartertools Smartermail

CVE-2026-104082 is a remote code execution vulnerability in SmarterMail prior to build 9777. An attacker holding a SysAdmin-scoped access token can bypass the Volume Mount script-directory containment by provisioning a mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. The attacker can disclose the Scripts path through the AddOrUpdateMount endpoint, disable the upload extension blacklist via the global-mail endpoint, and upload a malicious script through the mail file-storage upload API. Saving a CommandMount triggers RunScript before validation, resulting in execution of a reverse shell with SYSTEM-level privileges as the SmarterMail service account.

Successful exploitation allows an attacker with SysAdmin-scoped access token to execute arbitrary code remotely with SYSTEM-level privileges on the SmarterMail server. This leads to full system compromise, including the ability to run a reverse shell, bypassing normal script directory containment and upload restrictions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SysAdmin-scoped access tokens to trusted users only and monitor for suspicious activity related to domain provisioning and script uploads.