Code Execution Vulnerability in Progressive Robot hMailServer by hMailServer
CVE-2026-107571

7.8HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
19 October 2026

What is CVE-2026-107571?

The Progressive Robot hMailServer installer has improper default permissions, allowing local authenticated users to execute code with elevated privileges. The installation process places server programs in a Bin folder without appropriate permissions, enabling potential exploits if the product is installed in a writable directory. An ordinary user can manipulate these executable files or replace them, gaining unauthorized access to high-privileged accounts typically reserved for system processes or elevated administrative tasks. This flaw emphasizes the importance of adhering to secure installation practices and hardening file permission settings.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/78
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.