CVE-2017-9846

Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.

• CWE-22

• http://www.magicwinmail.com/changelog.phpRelease Notes, Vendor Advisory
• https://github.com/zhonghaozhao/winmail/issues/1Issue Tracking, Patch, Third Party Advisory
• http://www.magicwinmail.com/changelog.phpRelease Notes, Vendor Advisory
• https://github.com/zhonghaozhao/winmail/issues/1Issue Tracking, Patch, Third Party Advisory

Published

Jun 24, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9839Dolibarr ERP/CRM is affected by SQL injection in versions be…
• CVE-2017-9840Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users …
• CVE-2017-9841Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x bef…9.8
• CVE-2017-9843SAP NetWeaver AS ABAP 7.40 allows remote authenticated users…2.7
• CVE-2017-9844SAP NetWeaver 7400.12.21.30308 allows remote attackers to ca…7.5
• CVE-2017-9845disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remo…
• CVE-2017-9847The bdecode function in bdecode.cpp in libtorrent 1.1.3 allo…
• CVE-2017-9848SQL injection vulnerability in C_InfoService.asmx in WebServ…
• CVE-2017-9851An issue was discovered in SMA Solar Technology products. By…
• CVE-2017-9852An Incorrect Password Management issue was discovered in SMA…
• CVE-2017-9853An issue was discovered in SMA Solar Technology products. Al…
• CVE-2017-9854An issue was discovered in SMA Solar Technology products. By…