compose.php in @Mail WebMail Client in AtMail Open-Source prior to 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote malicious users to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
atmail atmail open |
Vulmon