CVE-2017-9846

CVE-2017-9846 describes a critical directory traversal vulnerability in Winmail Server 6.1, allowing authenticated users to achieve remote code execution. Attackers can exploit this by moving a malicious .php file from an FTP folder into a web-accessible directory via the netdisk.php move_folder_file function. With a CVSS score of 8.8 (HIGH), this vulnerability presents a significant risk due to its low attack complexity and potential for complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.