CVE-2026-107578: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Progressive Robot Ltd hMailServer
Description
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.
CVSS v3.1
Score 6.7medium
Affected software
Progressive Robot Ltd
hMailServer
pkg:github/hmailserver/hmailserverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-59) in hMailServer 6.3.4 and 6.3.5 arises from improper link resolution in administrative command-line operations. On Windows, operations running as administrator follow junctions and mount points that the low-privilege service account (NT SERVICE\hMailServer) can modify, allowing escalation to administrator privileges. On Linux, root-run operations follow symbolic links created by the service account (hmailserver user), enabling root-level file read, write, or removal. The flaw allows a local attacker controlling the service account to escalate privileges by manipulating file paths used by these operations.
Potential Impact
A local attacker who already has code execution as the low-privilege service account can escalate privileges to administrator on Windows or root on Linux. This includes unauthorized modification of log files, certificates, private keys, and message files, potentially compromising the integrity and confidentiality of the mail server environment. The vulnerability has a CVSS 3.1 score of 6.7 (medium severity), reflecting high impact on confidentiality, integrity, and availability but requiring local access and high attack complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the service account and monitor for unauthorized modifications of symbolic links or junctions in the data and log folders. Avoid running administrative or maintenance operations on untrusted systems or with untrusted service account control. Follow vendor guidance once published for official fixes or workarounds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitLab
- Date Reserved
- 2026-10-08T10:51:55.636Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac786ba2cdf04f65611bbbb
Added to database: 10/08/2026, 12:04:10 UTC
Last enriched: 10/08/2026, 12:19:19 UTC
Last updated: 10/08/2026, 15:04:12 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.