CVE-2026-107578 Improper Link Resolution Before File Access ('Link Following') in hMailServer
A local attacker with service account access can escalate privileges to administrator or root by exploiting improper link resolution in hMailServer administrative operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-107578?
CVE-2026-107578 is a medium-severity path traversal vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.
Weakness: CWE-59
Which versions are affected by CVE-2026-107578?
How do I fix CVE-2026-107578?
No fix has been published for CVE-2026-107578 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-107578 being exploited?
There is no known exploitation of CVE-2026-107578 in the wild and no public exploit code.
Sources
Also known as GHSA-f2xp-4p4c-fpc3.