CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer
An attacker with service account access can escalate privileges to root via the Linux live-update helper in hMailServer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104658?
CVE-2026-104658 is a high-severity vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.
Weakness: CWE-807
Which versions are affected by CVE-2026-104658?
How do I fix CVE-2026-104658?
No fix has been published for CVE-2026-104658 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104658 being exploited?
There is no known exploitation of CVE-2026-104658 in the wild and no public exploit code.
Sources
Also known as GHSA-xp25-6qr3-8c27.