CVE-2026-107578 in hMailServer
Summary
by MITRE • 10/08/2026
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves improper link resolution and external control of file paths within the administrative command-line operations of hMailServer.exe, specifically affecting versions 6.3.4 and 6.3.5 developed by Progressive Robot. This flaw represents a critical security deficiency that allows for local privilege escalation from a low-privilege service account to full administrator or root privileges depending on the underlying operating system architecture. The core issue stems from how the application handles file path resolution during administrative tasks, failing to adequately validate or restrict access to directories and files outside of intended boundaries when following symbolic links, junctions, or mount points.
On Windows systems, several administrative operations such as database setup, control panel interactions, and log management are executed with elevated administrator rights by default for the installer components. These processes write log entries and crash records into a designated log folder, manage self-signed certificates and private keys within the data folder, and rewrite message files stored in that same directory. Crucially, these operations rely on path-based access to folders that can be modified by the low-privilege service account, identified as NT SERVICE\hMailServer for new installations since version 6.3.4. The vulnerability arises because these elevated processes follow junctions and mount points without sufficient verification of their targets. Consequently, an attacker who has compromised or controls the local service account can manipulate these paths to redirect administrative actions toward sensitive system files or configurations located outside the intended data folder scope.
Furthermore, store-maintenance operations in Windows retrieve file names directly from the database, which is also writable by the service account. This allows an attacker to inject arbitrary filenames that point to locations beyond the restricted data directory. When the elevated process attempts to access these paths, it inadvertently interacts with files controlled by the low-privilege user but executed under high privileges. This mechanism enables the attacker to overwrite critical system files or modify permissions on sensitive resources, effectively bypassing standard Windows security boundaries and gaining administrative control over the host machine.
In Linux environments, the vulnerability manifests through store-maintenance and object-storage operations that execute with root privileges. The service account, typically packaged as hmailserver user owning the data folder, can plant symbolic links within this directory. When a privileged operation runs, it follows these symbolic links without validating their final destination. As a result, the root process reads from, writes to, or removes the target of the symlinked path rather than staying within the intended sandboxed area. This allows an attacker with control over the service account to manipulate files anywhere on the filesystem where they have write permissions for the link itself but gain read-write-execute access as root through the following mechanism.
The operational impact of this vulnerability is severe, enabling a local attacker who already possesses code execution rights under the low-privilege hMailServer service account to escalate privileges to that of an administrator on Windows or root on Linux. This escalation grants complete control over the server, allowing for data exfiltration, installation of persistent backdoors, modification of system configurations, and potential lateral movement within a networked environment. The flaw fundamentally undermines the principle of least privilege by allowing low-privilege processes to influence high-privilege operations through path manipulation techniques such as symlink following or junction traversal.
From an industry standards perspective, this vulnerability aligns with CWE-59 Improper Link Resolution Before File Access (Link Following), which describes flaws where a program uses user-supplied input to construct a file name but does not properly validate the link target before accessing it. Additionally, the attack vector relates to ATT&CK technique T1068 Exploitation for Privilege Escalation, specifically leveraging misconfigurations or vulnerabilities in system components to gain higher-level access. The scenario also touches upon CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) as the attacker leverages external control over file paths to escape restricted directories and interact with unauthorized locations on the filesystem.
Mitigation strategies must focus on strict input validation and secure path handling within administrative operations. Developers should ensure that all file access operations verify that resolved paths remain strictly within allowed directories, preventing traversal via symbolic links or junctions. Implementing chroot jails or containerization for service accounts can further isolate potential damage by restricting filesystem visibility. For immediate remediation, administrators should apply vendor patches as soon as they become available and review current configurations to ensure no unnecessary write permissions are granted to the hMailServer service account on directories containing sensitive system files or configuration data. Regular auditing of file access logs can also help detect attempts at path manipulation before successful exploitation occurs.