SmarterMail versions prior to build 9777 contain a remote code execution flaw that allows an authenticated attacker with SysAdmin-scoped rights to bypass volume mount containment controls. By creating a new mail domain with an arbitrary FileStore root inside the trusted Scripts directory via the domain-put endpoint, and then manipulating the AddOrUpdateMount, global-mail, and ordinary mail file‑storage APIs, the attacker can upload a malicious script. When the server processes the resulting CommandMount, it executes the script via RunScript before validation, delivering a reverse shell that runs as the SmarterMail service account with SYSTEM privileges.

All SmarterMail installations delivered by Smartertools that are built before build 9777 are affected. The vulnerability is fixed in Build 9777 and in all releases that follow.

The flaw carries a CVSS score of 8.6, indicating high severity, while the EPSS score is currently not available and the vulnerability is not listed in KEV. Attackers must possess a SysAdmin‑scoped access token to trigger the exploit; however, once present, the attack chain requires minimal additional steps and results in full control of the server. The exploit path involves known endpoints (domain‑put, AddOrUpdateMount, global‑mail) and the ordinary mail upload API, making detection and mitigation possible through endpoint restrictions or upgrades.