CVE-2006-5487: Directory traversal vulnerability in Marshal MailMarshal SMTP 5.x, 6.x, and 2006, and MailMarshal for Excha...

Security readout for executives and security teams

This issue affects older Marshal MailMarshal email security products. A malicious ARJ attachment could use path traversal in filenames to make the gateway write files outside the intended extraction directory. For an email gateway, that creates meaningful risk because attackers can reach it through normal mail flow. Exposure is most likely in legacy MailMarshal SMTP or MailMarshal for Exchange deployments that still process ARJ attachments. Internet-facing mail gateways, inbound attachment scanning paths, and archived or unsupported installations deserve priority review. Prioritize if any affected MailMarshal gateway remains in production or processes external mail. The business risk is highest where unsupported legacy email security infrastructure handles attachments before other controls can inspect them. Mitigation focus: Inventory MailMarshal SMTP and MailMarshal for Exchange versions in use.; Check Marshal KB 11450 and linked advisories for supported fixes.; Upgrade or retire affected legacy MailMarshal versions where guidance requires it..

Prepared

Jun 29, 2026, 09:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.