Threats tagged 'ghsa-hvr4-pggg-cr56'

A vulnerability in the Windows installer of Progressive Robot hMailServer versions 6.0.0 through 6.3.7 allows a local authenticated user to execute code with elevated privileges. This occurs due to improper link resolution when the installation path includes junctions, symbolic links, or mount points controlled or modifiable by other users. The installer does not verify control of these links before installation, enabling attackers to redirect the installation to locations they control and execute code as the mail server's service account or administrator. The default installation path under Program Files is not affected. The fix for a related vulnerability (CVE-2026-107571) in version 6.3.7 does not address this issue fully.