CVE-2004-2458: Open WebMail 2.30 and earlier, when use_syshomedir is disabled or create_syshomedir is enabled, creates new...

Security readout for executives and security teams

Open WebMail 2.30 and earlier can create directories before confirming a user is authenticated under specific configuration settings. A remote attacker could abuse this to create arbitrary directories on the server. The source bundle does not show code execution, data theft, active exploitation, or a CVSS score. Exposure is likely limited to legacy Open WebMail deployments at version 2.30 or earlier with the named configuration conditions. Internet-facing webmail instances would be the main concern. Modern environments are unlikely to be affected unless they still run this obsolete software. Treat this as a legacy hygiene risk, not an emergency based on current evidence. Prioritize remediation if Open WebMail is internet-facing or still supports business email access. Lack of exploit evidence lowers urgency, but pre-authentication filesystem changes are still operationally concerning. Mitigation focus: Identify any Open WebMail 2.30 or earlier deployments.; Review and apply the vendor SA-04:02 patch if applicable.; Avoid the vulnerable use_syshomedir/create_syshomedir configuration combination..

Prepared

Jun 29, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.