CVE-2017-9846
HIGHWinmail Server 6.1 - Authenticated Remote Code Execution via netdisk.php move_folder_file Path Traversal
Title source: llmDescription
Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.
References (2)
Core 2
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/zhonghaozhao/winmail/issues/1
Release Notes, Vendor Advisory x_refsource_misc
http://www.magicwinmail.com/changelog.php
Scores
CVSS v3
8.8
EPSS
0.0275
EPSS Percentile
84.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-22
Status
published
Products (1)
magicwinmail/winmail_server
6.1
Published
Jun 24, 2017
Tracked Since
Feb 18, 2026