Threats tagged 'ghsa-332h-7rh6-hg9m'

Progressive Robot hMailServer versions 6.2.3 through 6.3.7 on Windows, when configured with a MySQL or MariaDB database, improperly handle the path to authentication plugins. This flaw allows a local authenticated user to execute code with the hMailServer service's privileges by exploiting how the plugin folder path is converted and loaded, especially when the installation path contains certain non-ASCII characters. Version 6.3.8 addresses these issues by properly handling plugin folder paths and restricting plugin loading to secure locations. Linux builds and default installations under ASCII-only paths are not affected.