CVE-2026-114479 in hMailServer
Summary
by MITRE • 10/22/2026
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in hMailServer versions 6.0.0 through 6.3.6 represents a critical failure in secure design principles, specifically categorized under CWE-254: Security Features Misconfiguration or CWE-755: Improper Handling of Exceptional Conditions within the context of anti-virus processing logic. This flaw allows remote unauthenticated attackers to bypass server-side security controls by exploiting how the application handles non-textual email components during virus scanning operations. The core issue lies in the conditional logic used when stripping attachments from infected messages, which fails to account for edge cases where an entire message consists solely of a single binary or executable component rather than a multipart structure with distinct text and attachment parts.
Under normal operational parameters, hMailServer is configured to scan incoming emails for malware using integrated anti-virus engines. When the scanning action is set to remove attachments while delivering the remaining text content, the server attempts to parse the email into its constituent parts. For standard messages containing both textual body content and attached files, the system successfully identifies the infected attachment, removes it, replaces it with a notification note, and delivers the clean text portion to the recipient's mailbox. This behavior aligns with expected security postures where partial delivery of safe content is preferred over complete message deletion in certain configurations. However, this logic breaks down when the email structure deviates from the standard multipart format.
The vulnerability manifests specifically when an attacker sends a message that consists entirely of a single non-textual part. This scenario includes scenarios such as sending a malicious executable or archive file directly as the body of the email without wrapping it in a text container, embedding a malicious payload within an S/MIME signed message where the signature is treated as a single atomic unit, or utilizing MIME structures that obscure the attachment boundary from the parser's perspective. In these instances, because there is no separate textual part for the server to isolate and deliver, the anti-virus stripping mechanism finds no valid target for removal while maintaining delivery integrity. Consequently, rather than deleting the message entirely as it would in a default delete-action configuration, or failing safely by rejecting the input, the server delivers the infected content unchanged to the recipient's mailbox.
From an operational impact perspective, this flaw effectively neutralizes one of the primary defense layers provided by hMailServer’s built-in virus scanning capabilities for specific attack vectors. An attacker can reliably deliver malware, such as trojans, ransomware droppers, or malicious archives containing exploits, directly to user inboxes without triggering a quarantine or deletion event on the server side. The only trace of this security breach is a single line entry in the application log indicating that an infected message was processed, but no alerting mechanism prevents delivery nor does it block the payload at the transport layer. This allows for successful phishing campaigns and malware distribution that rely on users opening attachments or executing files received via email, bypassing expectations of server-side sanitization.
This behavior aligns with MITRE ATT&CK technique T1566.002: Spearphishing Attachment, where adversaries use malicious file types to compromise targets. The failure also reflects CWE-749: Exposed Dangerous Method or Property if viewed through the lens of improper input validation leading to unintended system state changes, though it is more accurately described as a logic error in security feature implementation. The lack of secure defaults means that even with virus scanning enabled and configured for attachment removal, the protection is incomplete due to this structural bypass.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators running affected versions should immediately upgrade hMailServer to version 6.3.7 or later, where this logic error has been corrected to ensure that messages consisting solely of non-textual parts are handled consistently with the chosen security policy, typically by deleting them if they contain malware rather than delivering them intact. In environments where upgrading is not immediately feasible, implementing a secondary mail gateway solution capable of deep packet inspection and MIME structure normalization can provide compensating controls. Additionally, configuring email clients to block all executable attachments regardless of server-side processing adds another layer of defense. Security teams should also monitor application logs for patterns indicating repeated delivery attempts from single-part binary payloads as an indicator of potential exploitation activity targeting this specific flaw.