EUVD-2026-94860
GHSA-f2xp-4p4c-fpc3
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Attacker needs an existing service-account foothold (PR:L) and local access (AV:L), must win a link-resolution race (AC:H) and rely on an admin-run operation (UI:R); escalation grants full admin/root CIA impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.
AnalysisAI
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 (fixed in 6.3.6) lets an attacker who already executes code as the low-privilege hMailServer service account ride a subsequent administrator- or root-run operation to full SYSTEM/root privileges. The flaw is improper link resolution (CWE-59): administrative command-line operations, the installer, DBSetup, the Control Panel, and store-maintenance/object-storage routines resolve file paths inside the log and data folders without guarding against junctions, mount points, or symbolic links that the service account can plant - and on Linux those maintenance routines run as root, so a planted symlink is followed with root authority. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already run code as the low-privilege service account - NT SERVICE\hMailServer (the default for new installations since 6.3.4) on Windows, or the packaged hmailserver user that owns the data folder on Linux. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority local privilege-escalation issue, not an internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade hMailServer to 6.3.6, the first release containing the fix, as published at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 and described in the upstream work item https://gitlab.com/hmailserver/hmailserver/-/work_items/71. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today