hMailServer: Local privilege escalation via link following in Windows installer
Summary
The Windows installer of hMailServer 6.0.0 through 6.3.7 accepts program folder paths that pass through junctions, symbolic links, mount points or renameable folders controlled by other local accounts. The service and the programs administrators run from the Bin folder can then be redirected to files that a low-privileged local user controls. An authenticated local user can thereby run code as the service account (LocalSystem or its virtual account) or as an administrator. The default installation under Program Files is not affected.
Affected
- hMailServer 6.0.0 through 6.3.7 (Windows installer)
- Installations whose program folder path passes through a link or renameable folder that other accounts control, for example a junction at the drive root
- Default installation under Program Files: not affected
Fixed in
- Fixed in hMailServer 6.3.8 (likely fix, not yet confirmed against the per-CVE vendor entry)
- CVE-2026-107571 (fixed in 6.3.7) does not cover this issue
Workaround
- Unknown. No vendor-published workaround found.
- Install hMailServer under Program Files, or at a path without links below folders that only administrators may change.
Exploitation
- Exploited in the wild: not reported.
- Public proof of concept: none found in research; not verified against exploit databases.
- Attack requires a local logon by a low-privileged account.
Our recommendation
- Upgrade all hMailServer servers running 6.3.7 or earlier to 6.3.8.
- Check whether the program folder is under Program Files; if not, check the path for junctions, symbolic links and mount points.
- Restrict who can rename or create folders above the program folder.
- Limit local logons on mail servers to administrators.
- Prioritise this on shared Windows servers and on installations outside Program Files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- hMailServer 6.3.8 release (GitLab) gitlab.com
- Work item #78: Windows installer permissions (GitLab) gitlab.com
- CVE-2026-107571 CVE Record www.cve.org
- VulDB entry 435717 vuldb.com
- OffSeq Radar: CVE-2026-126612 radar.offseq.com
- OSV: CVE-2026-107571 vulners.com
- Progressive Robot hMailServer 6.3.8 downloads www.progressiverobot.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:23.
Original description (NVD)
Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.