Medium severity · published Apr 24, 2019
CVE-2019-7213
SmarterTools SmarterMail 16.x before build 6985 allows directory traversal
6.5
CVSS
41.5%
EPSS
No
On KEV
Description
SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside the web directories.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)41.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Smartermail · Smartertools
16.0.6345 before 16.3.6985 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7213
Third Party Advisory
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/
Release Notes
https://www.smartertools.com/smartermail/release-notes/current
More from Smartermail
10.0
CVE-2025-52691
Upload Arbitrary Files
9.8
CVE-2026-24423
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
9.8
CVE-2026-23760
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
9.8
CVE-2021-32234
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution
9.8
CVE-2019-7214
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data