SmarterTools SmarterMail Local File Inclusion Vulnerability (CVE-2026-7807)

SmarterTools SmarterMail, a widely used mail server software, is vulnerable to a local file inclusion (LFI) flaw tracked as CVE-2026-7807. This vulnerability affects builds prior to 9560. Authenticated users can exploit the vulnerability by crafting specific requests to the /api/v1/report/summary/{type} API endpoint, enabling them to read arbitrary .json files from the server’s file system. Successful exploitation, combined with weak encryption and hardcoded keys, may allow attackers to decrypt and steal stored passwords and 2FA secrets for all users. This poses a significant risk to the confidentiality and integrity of the SmarterMail server and its user accounts.

Attack Chain

1. An attacker authenticates to the SmarterMail web interface.
2. The attacker crafts a malicious HTTP GET request to the /api/v1/report/summary/{type} endpoint.
3. The {type} parameter is manipulated to include a path traversal sequence (e.g., ../../../../) to target a specific .json file outside the intended directory.
4. The SmarterMail server processes the request without proper input validation, allowing the attacker to read the contents of the specified .json file.
5. The attacker targets .json files containing sensitive information, such as configuration files or password stores.
6. The attacker leverages weak encryption algorithms and hardcoded keys (if present) to decrypt the contents of the stolen .json files.
7. The attacker extracts user credentials, including passwords and 2FA secrets, from the decrypted data.
8. The attacker uses the stolen credentials to compromise user accounts and gain unauthorized access to sensitive data.

Impact

Successful exploitation of CVE-2026-7807 can lead to the complete compromise of a SmarterMail server. Attackers can steal user credentials, including passwords and 2FA secrets, potentially impacting all users on the system. This access enables attackers to read sensitive emails, send malicious emails, and potentially pivot to other systems on the network. The impact includes data breaches, financial loss, and reputational damage.

Recommendation

• Upgrade SmarterMail to build 9560 or later to patch CVE-2026-7807 (reference: overview).
• Implement the Sigma rule Detect SmarterMail LFI Attempt to detect exploitation attempts against the /api/v1/report/summary/{type} endpoint (reference: rules).
• Monitor web server logs for suspicious requests containing path traversal sequences in the /api/v1/report/summary/{type} endpoint (reference: rules logsource).