SmarterTools SmarterMail versions before 9560 contain a CWE-22 path traversal vulnerability in the /api/v1/report/summary/{type} API endpoint. Authenticated users can exploit this flaw to perform local file inclusion and read arbitrary JSON files on the server. The vulnerability is compounded by weak encryption algorithms and hardcoded keys, which attackers can leverage to decrypt and access stored user passwords and 2FA secrets. The CVSS 4.0 score is 8.7, reflecting high impact and exploitability with low attack complexity and no user interaction required. No official patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows an authenticated attacker to read arbitrary JSON files on the affected system, potentially exposing sensitive information such as stored passwords and two-factor authentication secrets. This can lead to significant compromise of user accounts and overall system security. The vulnerability is rated high severity with a CVSS score of 8.7, indicating a serious risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoint to trusted users only and monitor for suspicious activity involving file access. Avoid using weak encryption algorithms and hardcoded keys for sensitive data storage. Follow vendor updates closely for any forthcoming patches or official mitigations.