AcyMailing Enterprise EUVD-2026-87772

Requires the AcyMailing Enterprise 'mailbox action' feature to be enabled and actively monitoring an inbound mailbox (used for bounce/reply processing) - this is the concrete precondition (AT:P) and is not a default configuration. Given that feature, exploitation is unauthenticated and trivial: the attacker only needs to know or guess the monitored email address and send a message whose MIME part contains PHP, since media/com_acym/upload/ performs no extension check and is web-accessible. Limiting factors: affected only on AcyMailing Enterprise < 11.1.0 with mailbox monitoring configured; the upload directory must be reachable via HTTP and PHP-executable (typical default), and successful RCE runs at the privilege of the web-server account.

This is a genuinely high-impact flaw whose real-world risk hinges on a single deployment precondition. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction - an attacker merely sends an email to the monitored mailbox - and CWE-434 (unrestricted upload writing a PHP file into the web root) yields full code execution, justifying the 9.5 vendor score. However, the vector carries AT:P (Attack Requirement: Present), which matches the description's dependency on the optional 'mailbox action' inbound-mail feature being configured; without that feature enabled and monitoring a mailbox, the code path is never reached. No EPSS score, no CISA KEV listing, and no POC are present in the provided data, so there is no evidence of active or automated exploitation - this reads as a serious-but-not-yet-weaponized issue whose priority is gated by how many installs actually run the mailbox feature. The vendor's use of SC:H/SI:H/SA:H (full subsequent-system impact) appears inflated: RCE lands as the web-server account on the same host rather than clearly compromising a separate downstream system - verify scope with the vendor. Net: prioritize for any site running AcyMailing Enterprise with inbound mailbox monitoring; deprioritize where that feature is off.

An attacker sends a crafted email containing a MIME attachment whose payload is PHP source (e.g. a webshell) to the mailbox that AcyMailing Enterprise is configured to monitor. The extension saves the MIME part to media/com_acym/upload/ without checking the file extension, dropping a .php file into the web root; the attacker then requests that file over HTTP to execute arbitrary code as the web-server account. No public exploit was identified at time of analysis, but the attack requires only the ability to send email to a known address.