---
id: "CVE-2010-4345"
kind: "vulnerability"
aliases: ["CVE-2010-4345"]
title: "Exim Exim: Exim Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.17965
exploited: true
status: "open"
category: "package"
products: [{"name": "Exim Exim", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exim", "exploited", "linux", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "no-local-user-access"]
published_at: "2010-12-14T16:00:04+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-4345", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-4345", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4345", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Exim Exim: Exim Privilege Escalation Vulnerability

Exim, the mail transfer agent, lets a local user who already has the exim account specify an alternate configuration file containing arbitrary commands. An attacker who gets local access can run commands as the exim user and escalate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Exim Exim affected ? fixed ?

## Fix

Apply the vendor update per Exim's instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-4345
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-4345
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-4345

## From the sources

Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_