CVE-2004-2458: Open Webmail

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

Open WebMail 2.30 and earlier, when use_syshomedir is disabled or create_syshomedir is enabled, creates new directories before authenticating, which allows remote attackers to create arbitrary directories.

Affected products

• Open Webmail Open Webmail: version 1.7 only; version 1.8 only; version 1.71 only; version 1.81 only; version 1.90 only; version 2.30 only

Published 2004-12-31. Last modified 2026-06-16.