Improper Link Resolution in hMailServer by Progressive Robot
CVE-2026-126612

7.8HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126612?

The vulnerability in hMailServer versions 6.0.0 through 6.3.7 stems from improper link resolution during installation. Local authenticated users can exploit this flaw to execute arbitrary code by manipulating the program installation path through junctions, symbolic links, or mount points. Because the installation process does not verify the controlling permissions of these paths, an attacker could redirect the installation of server-side applications to directories they control, leading to potential gains of administrator privileges or access to the mail server's service account. Notably, the fix introduced in version 6.3.7 does not adequately address all scenarios, as it only hardens specific folders without completely securing the installation paths themselves.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/78
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8
https://www.cve.org/CVERecord?id=CVE-2026-107571

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.