CVE-2026-6351 Details
Description
MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.
A CRLF injection vulnerability has been identified in Openfind's MailGates/MailAudit, specifically in versions 6.0 prior to 6.1.10.054 and 5.0 prior to 5.2.10.099. This vulnerability allows unauthenticated remote attackers to inject carriage return and line feed characters, potentially leading to the manipulation of HTTP headers. Exploitation of this vulnerability could enable attackers to read sensitive system files.
Users of MailGates/MailAudit 6.0 should update to version 6.1.10.054 or later. Users of MailGates/MailAudit 5.0 should update to version 5.2.10.099 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 16, 2026CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.twcert.org.tw/en/cp-139-10843-9ff91-2.html | [email protected] | AdvisoryBundleRemedy |
| https://www.twcert.org.tw/tw/cp-132-10844-1405d-1.html | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Openfind MailGates | All versions |
CPE
Remediation
| |
| Openfind MailAudit | < 6.1.10.054 < 5.2.10.099 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |