IT SBIT Services
Schneeberger
DEEN
CVE tracker

hMailServer: Incorrect default permissions in Windows installer

CVE-2026-126625Medium 6.7

← All vulnerabilities

Summary

The Windows installer of hMailServer 6.3.7 sets insecure permissions when the program is installed into a new folder in a location where all users can write, such as the root of a drive. For a window of tens of milliseconds during setup, any local account can create files in the new folder, including the Bin folder, before the permissions are tightened. A local user can then get code run with the rights of the administrator who performs the installation, and the service can be affected. The default installation under Program Files is not affected.

Affected

  • hMailServer 6.3.7 (CVE record: affected, default installation unaffected)
  • Only installations into a new folder in a location whose permissions let every user write, such as the root of a drive
  • Default installation under Program Files: not affected

Fixed in

  • hMailServer 6.3.8 (vendor's solution per CVE record)

Workaround

  • Install hMailServer under Program Files, or into a new folder inside a folder that only administrators may change.
  • To install elsewhere, first create the program folder from an elevated Command Prompt and protect it: icacls "<program folder>" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F

Exploitation

  • No evidence of exploitation in the wild found. Not known to be exploited (OffSeq).
  • No public proof of concept found in the research; no exhaustive check was performed.

Our recommendation

  • Inventory all hMailServer installations and their folder paths; flag installations outside Program Files and installations at a drive root.
  • Upgrade to hMailServer 6.3.8 or later and verify the signature of the installer.
  • Restrict write permissions on installation folders (program folder, Bin, ControlPanel) to administrators.
  • Restrict local logons on multi-user Windows servers to trusted accounts, and monitor the folders for unexpected changes.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:18.

Original description (NVD)

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but its setup lets Inno Setup make a new program folder first, with the permissions the folder above hands down, and replaces them only afterwards, tens of milliseconds later (33 to 139 milliseconds in the project's test runs). In that time any local account may make files and folders in the new folder, which keep that account as their owner, among them the Bin folder that setup then copies the programs into. Setup runs programs from Bin with the administrator's elevated rights, registering the service among them, before its hardening at the end of setup takes such a folder back, and those programs load a library placed in Bin in place of the system's. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed