Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-104658 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CNA: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6	[email protected]	Release NotesVendor
https://gitlab.com/hmailserver/hmailserver/-/work_items/58	[email protected]	ExploitIssue TrackingTechnical DescriptionVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-807	Reliance on Untrusted Inputs in a Security Decision	[email protected]

Affected Products

Product	Versions
Progressive Robot hMailServer	6.3.4 (semver) 6.3.5 (semver)
CPE cpe:2.3:a:hmailserver:hmailserver:::::::: Remediation Upgrade: 6.3.6moderate effort Workaround:low effort Disable the hmailserver-update.path unit with the command: systemctl disable --now hmailserver-update.path. This will prevent the live update from being applied while the update check and download continue. Workaround:low effort For AppImage installations running under the hmailserver-update.path unit, copy the hmailserver-update script from version 6.3.6 to /usr/lib/hmailserver/ and configure it to use the --image option in a drop-in for hmailserver-update.service.

Product

Versions

Progressive Robot hMailServer

6.3.4 (semver)

6.3.5 (semver)

CPE

cpe:2.3:a:hmailserver:hmailserver:*:*:*:*:*:*:*:*

Remediation

Upgrade: 6.3.6moderate effort
Workaround:low effort
Disable the hmailserver-update.path unit with the command: systemctl disable --now hmailserver-update.path. This will prevent the live update from being applied while the update check and download continue.
Workaround:low effort
For AppImage installations running under the hmailserver-update.path unit, copy the hmailserver-update script from version 6.3.6 to /usr/lib/hmailserver/ and configure it to use the --image option in a drop-in for hmailserver-update.service.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 8, 2026	CVE Modified	CISA-ADP
Oct 8, 2026	New CVE Received	[email protected]