Improper Link Resolution Before File Access ('Link Following') in hMailServer
Summary
| CVE | CVE-2026-126612 |
|---|---|
| State | PUBLISHED |
| Assigner | GitLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 09:17:13 UTC |
| Updated | 2026-11-11 09:17:13 UTC |
| Description | Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-59 | CWE-59 CWE-59: Improper Link Resolution Before File Access ('Link Following')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Progressive Robot Ltd | HMailServer | affected 6.0.0 6.3.7 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cve.org/CVERecord | [email protected] | www.cve.org | |
| gitlab.com/hmailserver/hmailserver/-/work_items/78 | [email protected] | gitlab.com | |
| gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 | [email protected] | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Found by the hMailServer project (Progressive Robot Ltd) (en)
Additional Advisory Data
Solutions
CNA: Upgrade to hMailServer 6.3.8, whose setup holds every folder from the root of the volume down to the program folder, Bin and ControlPanel open and, before anything changes, refuses with exit code 7 a junction, a symbolic link or a mount point on the way that anybody but SYSTEM, the Administrators and TrustedInstaller owns, may change or may remove - a junction made at a drive's root and left with the permissions the root hands down among them - and a folder on the way that another account may rename or remove, or empty, naming each with the icacls that deals with it. Until then, install hMailServer under Program Files, or at a path with no link on it below folders that only administrators may change. For a link that is meant to be on the path, make it the administrators' alone from an elevated Command Prompt - icacls "<link>" /L /setowner *S-1-5-32-544, then icacls "<link>" /L /inheritance:r /grant:r *S-1-5-18:F *S-1-5-32-544:F *S-1-5-32-545:RX - and check where it leads (dir /al of the folder that holds it); make the Administrators the owner of each folder above the program folder that other accounts may change, and take away their right to change it; then restart Windows. Where another account owned or could change such a link or folder while the installation was there, reinstall into a new folder as the hMailServer documentation, ServiceAccount.md, "Reinstalling into a new folder", says.