{"id":"CVE-2026-124579","kind":"vulnerability","aliases":["CVE-2026-124579"],"related":[],"title":"aaPanel BillionMail: relay configuration API lets remote attackers inject commands","description":"A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"BillionMail, an open-source email server panel from aaPanel, has an injection flaw in its Relay Configuration API through the helo_name argument in core/api/relay/v1/relay.go. A remote attacker can manipulate that argument to inject content, and a public exploit has been disclosed.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BillionMail","fixed":[],"affected":"<= 4.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["aapanel","billionmail","email","other","self-hosted"],"not_affected_if":["not-billionmail"],"how_to_check":"Check your BillionMail version (4.9 and earlier are listed as affected by NVD); check whether the relay configuration API (core/api/relay/v1/relay.go) is reachable from untrusted networks and review relay HELO name settings for shell metacharacters. Unconfirmed: no vendor advisory found.","fix":null,"status":"open","published_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","triaged_at":"2026-11-09T08:25:51+00:00","updated_at":"2026-11-09T08:27:20+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-09T08:25:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"aaPanel BillionMail: relay configuration API lets remote attackers inject commands","impact":"high","summary":"BillionMail, an open-source email server panel from aaPanel, has an injection flaw in its Relay Configuration API through the helo_name argument in core/api/relay/v1/relay.go. A remote attacker can manipulate that argument to inject content, and a public exploit has been disclosed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["billionmail","aapanel","self-hosted","email"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote injection into the relay configuration, possibly code execution","analyst_note":"Check the NVD entry and the linked advisory for the fixed version, whether the injection leads to code execution, and whether the relay API needs authentication.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-billionmail"],"who_is_affected":"Teams that run BillionMail up to version 4.9 with the relay configuration API reachable from the network are exposed. The sources do not say whether the API is exposed by default or which deployments are affected. Teams not running BillionMail can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4590,"output_tokens":479,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the linked advisory for the fixed version, whether the injection leads to code execution, and whether the relay API needs authentication.","search":"'-124579':13A,16A '-2026':12A,15A '4.9':77C 'aapanel':1A,18B,34B,73C 'affect':78C 'api':5A,43B,95C 'argument':48B,57B,101C 'attack':8A,53B,109C 'billionmail':2A,17A,19B,25B,74C 'command':10A 'compon':92C 'configur':4A,42B,94C 'contact':128C 'content':60B 'core/api/relay/v1/relay.go':50B,89C 'cve':11A,14A 'determin':71C 'disclos':67B,120C 'disclosur':132C 'earli':129C 'email':20B,30B 'execut':96C 'exploit':64B,116C 'file':88C 'flaw':38B 'function':85C 'helo':46B,102C 'host':24B 'inject':9A,37B,59B,107C 'issu':81C 'lead':105C 'let':6A 'manipul':55B,98C 'may':110C,122C 'name':47B,103C 'open':28B 'open-sourc':27B 'panel':32B 'perform':112C 'public':63B,119C 'relay':3A,41B,93C 'remot':7A,52B,114C 'respond':136C 'self':23B 'self-host':22B 'server':31B 'sourc':29B 'unknown':84C 'util':124C 'vendor':126C 'vulner':69C 'way':139C","nicknames":[],"mitigations":[],"who_affected":"Teams that run BillionMail up to version 4.9 with the relay configuration API reachable from the network are exposed. The sources do not say whether the API is exposed by default or which deployments are affected. Teams not running BillionMail can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["billionmail"],"ptokens":["billionmail"],"labels":["aapanel","billionmail","email","high","other","selfhosted"],"campaign_type":null,"search_a":"'-124579':13A,16A '-2026':12A,15A 'aapanel':1A 'api':5A 'attack':8A 'billionmail':2A,17A 'command':10A 'configur':4A 'cve':11A,14A 'inject':9A 'let':6A 'relay':3A 'remot':7A","search_b":"'aapanel':18B,34B 'api':43B 'argument':48B,57B 'attack':53B 'billionmail':19B,25B 'configur':42B 'content':60B 'core/api/relay/v1/relay.go':50B 'disclos':67B 'email':20B,30B 'exploit':64B 'flaw':38B 'helo':46B 'host':24B 'inject':37B,59B 'manipul':55B 'name':47B 'open':28B 'open-sourc':27B 'panel':32B 'public':63B 'relay':41B 'remot':52B 'self':23B 'self-host':22B 'server':31B 'sourc':29B","search_c":"'4.9':77C 'aapanel':73C 'affect':78C 'api':95C 'argument':101C 'attack':109C 'billionmail':74C 'compon':92C 'configur':94C 'contact':128C 'core/api/relay/v1/relay.go':89C 'determin':71C 'disclos':120C 'disclosur':132C 'earli':129C 'execut':96C 'exploit':116C 'file':88C 'function':85C 'helo':102C 'inject':107C 'issu':81C 'lead':105C 'manipul':98C 'may':110C,122C 'name':103C 'perform':112C 'public':119C 'relay':93C 'remot':114C 'respond':136C 'unknown':84C 'util':124C 'vendor':126C 'vulner':69C 'way':139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124579","severity":null,"published_at":"2026-11-09T08:17:02+00:00","modified_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","fetched_at":"2026-11-09T08:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124579:2260","url":"https://github.com/aaPanel/BillionMail/releases","severity":null,"published_at":"2026-11-09T08:27:20+00:00","modified_at":"2026-11-09T08:27:20+00:00","first_seen_at":"2026-11-09T08:27:20+00:00","fetched_at":"2026-11-09T08:27:20+00:00","note":"Only NVD/VulDB text available: affects BillionMail up to 4.9, helo_name in relay API, remote, PoC public per NVD (no link found), vendor did not respond. v4.9 is the latest release (GitHub releases page, no security fix noted), so no fixed version known. Auth requirement and code-execution outcome not confirmed (CVSS vector PR:L suggests low privileges needed; impact rated Low). Exa search out of credits, so no PoC or discussion found; nothing verified.","cites":["https://github.com/aaPanel/BillionMail/releases"]}],"documents":[{"id":106568,"url":"https://github.com/aaPanel/BillionMail/releases","title":"BillionMail releases","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}