BILLIONMAIL · CVE-2026-124579 · Other
NO FIX YET
BillionMail, an open-source email server panel from aaPanel, has an injection flaw in its Relay Configuration API through the helo_name argument in core/api/relay/v1/relay.go. A remote attacker can manipulate that argument to inject content, and a public exploit has been disclosed.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run BillionMail up to version 4.9 with the relay configuration API reachable from the network are exposed. The sources do not say whether the API is exposed by default or which deployments are affected. Teams not running BillionMail can skip it.
Not affected if not-billionmail
Who cares aapanel, billionmail, email, self-hosted
No fix yet, per the sources.
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.