CVE-2026-107578
Received Received - Intake

Privilege Escalation in hMailServer via Path Traversal

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitLab Inc.

Description
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107578
EUVD
EUVD-2026-94860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.3.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in hMailServer versions 6.3.4 and 6.3.5 on Windows and versions 6.3.0 through 6.3.5 on Linux. It occurs because administrative commands executed by the hMailServer service account can follow symbolic links or junctions, allowing an attacker with service account access to manipulate files owned by administrators. On Windows, elevated commands can write to folders controlled by the service account, enabling file creation, modification, or deletion with administrative privileges. On Linux, root-run commands can follow symbolic links planted in the log directory, allowing root to modify arbitrary files.

Detection Guidance

To detect this vulnerability, check for symbolic links or junctions in critical directories like the hMailServer log or data folders. On Windows, use commands like 'dir /al' in Command Prompt or 'Get-ChildItem -Recurse -Attributes ReparsePoint' in PowerShell. On Linux, use 'find / -type l' to locate symbolic links in system directories.

Impact Analysis

If you are an administrator or user of hMailServer versions 6.3.4 or 6.3.5 on Windows or versions 6.3.0 through 6.3.5 on Linux, an attacker with access to the service account could escalate their privileges to administrator or root level. This could allow them to take full control of the system, modify critical files, or disrupt services. The attacker needs existing service account access and for an administrator to run a vulnerable command.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements such as GDPR or HIPAA. If an attacker gains root or administrator privileges, they could access, alter, or delete protected data, leading to legal and regulatory penalties. Organizations must patch this vulnerability to maintain compliance.

Mitigation Strategies

Upgrade hMailServer to version 6.3.6 or later to apply the fix. Avoid running administrative commands as root on Linux or with elevated privileges on Windows. Restrict service account permissions and audit folder access to prevent unauthorized file manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart