Attachment Stripping Flaw in hMailServer by Progressive Robot
CVE-2026-114479

5.8MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114479?

A flaw in the attachment-stripping process of hMailServer allows remote unauthenticated attackers to deliver infected messages unchanged. The anti-virus functionality, when configured to strip attachments, fails to handle certain message types appropriately. Specifically, if a message is sent as a non-text format, such as an application or an archive, the server unduly delivers the entire message to the recipient without altering its content. This oversight poses a significant security risk, as it enables attackers to bypass the protections intended to mitigate the delivery of potentially harmful content.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/92
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.