EUVD-2026-94832
GHSA-xp25-6qr3-8c27
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing low-privileged service-account foothold (PR:L, AV:L), no interaction, and yields full root compromise (C/I/A:H); scope unchanged as escalation stays on the same system.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has code execution as the unprivileged hmailserver service account to run arbitrary code as root via the live-update apply helper (hmailserver-update). The vulnerability requires the live-update path unit to be active, which is the default for the project's .deb and .rpm packages and applies to AppImage installations run under that unit, but does not affect non-Linux builds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already execute code as the unprivileged hmailserver service account (a local foothold, consistent with PR:L), and the live-update path unit must be active - which is the default for the project's .deb and .rpm packages, and also applies to AppImage installations run under that unit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible local privilege-escalation issue rather than a remote-attack headline. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer version 6.3.6 or later (https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running Progressive Robot hMailServer 6.3.4 or 6.3.5 and verify whether the live-update path unit is active, including AppImage installations under that unit; isolate critical instances if feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Share
External POC / Exploit Code
Leaving vuln.today