IceWarp vulnerabilities
We track 5 vulnerabilities in IceWarp products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 16, 2026.
Latest IceWarp vulnerabilities
- 7.5 High severity
IceWarp: Improper Limitation of a Pathname to a Restricted Directory
IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The
- 9.8 Critical severity
IceWarp: Improper Neutralization of Special Elements used in an OS Command
IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The speci
- 8.8 High severity
IceWarp: Improper Neutralization of Input During Web Page Generation
IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must
- 9.8 Critical severity
Mail Server: Improper Limitation of a Pathname to a Restricted Directory
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
- 9.8 Critical severity
Webclient Dc2: Improper Neutralization of Special Elements used in an SQL Command
IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.