Skip to content
Heist/ feed
High

Reliance on Untrusted Inputs in a Security Decision in hMailServer

Type: advisorySource: Official CVE List1 source record

The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.

Announced Source revision 1
Original source ↗

CVE-2026-104658

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-104658

hMailServer

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://gitlab.com/hmailserver/hmailserver",
    "vendor": "Progressive Robot Ltd",
    "product": "hMailServer",
    "versions": [
      {
        "status": "affected",
        "version": "6.3.4",
        "lessThan": "6.3.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-104658

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#13053 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement