Read the docs
TI-2004-01597 Aliases CVE-2004-1721GHSA-pwcm-4994-52jq

The (1) function.php or (2) function.view.php scripts in Merak Mail Server 5.2.7 allow…

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The (1) function.php or (2) function.view.php scripts in Merak Mail Server 5.2.7 allow remote attackers to read arbitrary PHP files via a direct HTTP request to port 32000.

Why it matters now

EPSS 0.02351 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:merak:mail_server:5.2.7:*:*:*:*:*:*:*5.2.7VulnerableMerak
  • cpe:2.3:a:merak:mail_server:5.2.7:*:*:*:*:*:*:* Versions 5.2.7 Vulnerable ·Merak

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-1721
  2. 2026-10-03 Alias added: GHSA-pwcm-4994-52jq

References

Patch 2

Other 1

  • TI-2005-04289 PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail… CVSS 2.0HIGH 7.5
  • TI-2005-04291 IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server… CVSS 2.0MEDIUM 6.5
  • TI-2004-01598 SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote… CVSS 2.0HIGH 7.5
  • TI-2004-01550 viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other… CVSS 2.0HIGH 7.5
  • TI-2004-01546 Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web… CVSS 2.0HIGH 7.5
  • TI-2002-00247 Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not… CVSS 2.0HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences