CVE-2026-124579
Deferred Deferred - Pending Action

Injection in aaPanel BillionMail Relay Configuration API

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulDB

Description
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124579
EUVD
EUVD-2026-119873

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authenticated Remote Code Execution (RCE) flaw in aaPanel BillionMail versions up to 4.9. It allows attackers to inject malicious commands via the helo_name parameter in the Relay Configuration API. The attack involves crafting a request with a newline and service definition to override Postfix's master.cf configuration, enabling a reverse shell when an email is sent.

Detection Guidance

Check for unauthorized relay configurations in BillionMail's API logs or Postfix configuration files. Look for suspicious `helo_name` values containing newline characters or service definitions in `/api/relay/add` requests. Monitor for unexpected `postfix reload` commands executed as root.

Impact Analysis

An attacker could gain full control over the affected system by executing arbitrary commands as the nobody user. This could lead to data theft, system compromise, or further network infiltration. The attack requires authentication but can be automated with a script.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or loss of sensitive information, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Upgrade BillionMail to the latest version if available. Disable the `/api/relay/add` endpoint if not needed. Implement strict input validation for the `helo_name` parameter. Restrict Postfix container permissions to prevent root-level command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...