hMailServer CVE-2026-114479

Exploitation requires the server to have virus scanning ENABLED and its action configured to the NON-default 'remove attachments and deliver the text' mode - the default action deletes infected messages and is not vulnerable. The malicious email must also be structured as a single non-text MIME part (a standalone program or archive sent as the whole message, a message carried whole, a file declared as the sole attachment, or a one-part S/MIME-signed message), so the attachment-stripping logic has no separate text part to isolate. No authentication is required (PR:N) and any sender can compose such a message; the principal limiting factors are the non-default scanner-action setting and the fact that real-world harm additionally depends on the recipient's mail client opening the delivered content.

This is a medium-severity integrity/security-control bypass (CVSS 5.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) rather than a top-tier priority. The signals point to limited real-world risk: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - so this is 'no public exploit identified at time of analysis.' The CVSS vector indicates network reach, low complexity, and no authentication (any sender can email the server), and the scope change (S:C) correctly reflects that the failure's impact lands on the recipient's mailbox/mail client rather than the server itself. However, the raw base metrics understate a key limiting factor: exploitation only works when the operator has selected the NON-default anti-virus action ('remove attachments and deliver the text') - the shipped default deletes infected messages outright and is not affected. The CWE-636 ('Not Failing Securely') classification matches the described behavior precisely. Net: a legitimate defense-in-depth bypass worth patching, but materially constrained by a non-default configuration dependency and by the fact that final harm requires the recipient to open the delivered content. EPSS/KEV/POC data is absent, so no exploitation-probability signal is available to contradict or reinforce the moderate CVSS.

An attacker sends an email to a hMailServer instance (6.0.0-6.3.6) that has virus scanning enabled with its action set to the non-default 'remove attachments, deliver the text' mode. The attacker crafts the message as a single non-text MIME part - e.g. an executable, an archive, a whole forwarded message, a file declared as an attachment, or a single-part S/MIME-signed message - so the stripping logic finds no separate text part to preserve and therefore delivers the scanner-flagged infected content to the recipient unchanged, with only an application-log line as evidence. No public exploit code is identified, but crafting such a message requires no special tooling and no authentication.