CVE-2017-9846

2017-06-2417:00:00

mitre

www.cve.org

AI Score

8.9

Confidence

High

EPSS

0.004

Percentile

73.6%

JSON

Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.

References

www.magicwinmail.com/changelog.php

github.com/zhonghaozhao/winmail/issues/1