Reliance on Untrusted Inputs in a Security Decision in hMailServer
Summary
| CVE | CVE-2026-104658 |
|---|---|
| State | PUBLISHED |
| Assigner | GitLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-08 11:16:43 UTC |
| Updated | 2026-10-08 21:02:43 UTC |
| Description | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-807 | CWE-807 CWE-807: Reliance on Untrusted Inputs in a Security Decision
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Progressive Robot Ltd | HMailServer | affected 6.3.4 6.3.6 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 | [email protected] | gitlab.com | |
| gitlab.com/hmailserver/hmailserver/-/work_items/58 | [email protected] | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Found in the hMailServer project's own security review (Progressive Robot Ltd) (en)
Additional Advisory Data
Solutions
CNA: Upgrade to hMailServer 6.3.6, whose helper takes the unit and the AppImage only from its own root-owned command line, refuses an AppImage request where that names none, confirms that the server has stopped, and verifies, runs and installs only copies it made after the stop, readable by root alone until they have verified. Install 6.3.6 with the package manager (apt or dnf) rather than through the live update. An AppImage run under the path unit keeps the helper script copied to /usr/lib/hmailserver/ when its update units were installed, which the AppImage's own update does not replace: copy 6.3.6's script there and give it --image in a drop-in for hmailserver-update.service. Until then: systemctl disable --now hmailserver-update.path, which turns the apply off while the update check and download go on. Windows, builds with -DHM_LIVE_UPDATE=OFF and the container image are not affected.