The (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Neomail | Neomail | * | 1.28 (including) |