SQL Injection Vulnerability in Progressive Robot hMailServer from MySQL and PostgreSQL
CVE-2026-126617

8.8HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126617?

The vulnerability in Progressive Robot hMailServer allows attackers to exploit SQL injection weaknesses present in MySQL and PostgreSQL database backends. This allows unauthorized users to manipulate SQL statements executed by the server, potentially leading to the execution of arbitrary SQL commands. The flaw arises from how input parameters are handled, leaving opportunities for attackers to interfere with the integrity of database queries. Affected versions prior to 6.2.19 may allow for misuse by both authenticated and unauthenticated users when certain email functionalities are utilized. Security measures are crucial to mitigate this risk and preserve database confidentiality and integrity.

Affected Version(s)

hMailServer 6.0.0-B1 <= 6.2.18

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/101
https://gitlab.com/hmailserver/hmailserver/-/releases/v6....

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.