CVE-2006-0711: Neomail

Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days.

The (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled.

Affected products

• Neomail Neomail: up to and including 1.28

Published 2006-02-15. Last modified 2026-06-16.