CVE-2026-25067 Details
Description
SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication.
A path coercion vulnerability has been identified in SmarterTools SmarterMail versions prior to build 9518. This vulnerability exists in the background-of-the-day preview endpoint, where the application decodes base64-encoded input from attackers and uses it as a filesystem path without proper validation. On Windows systems, this flaw enables the resolution of UNC paths, leading the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This behavior can be exploited for credential coercion, NTLM relay attacks, and unauthorized network authentication.
Users are advised to update to SmarterTools SmarterMail version 100.0.9518 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.smartertools.com/smartermail/release-notes/current | [email protected] | Release Notes |
| https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-background-of-the-day-path-coercion | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| smartertools smartermail | < 100.0.9518 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | Initial Analysis | [email protected] |
| Jan 29, 2026 | New CVE Received | [email protected] |