---
id: "CVE-2026-124579"
page: "https://infrastack.ai/live/CVE-2026-124579"
kind: "vulnerability"
aliases: ["CVE-2026-124579"]
title: "aaPanel BillionMail: relay configuration API lets remote attackers inject commands"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "BillionMail", "fixed": [], "affected": "<= 4.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aapanel", "billionmail", "email", "other", "self-hosted"]
not_affected_if: ["not-billionmail"]
published_at: "2026-11-09T08:17:02+00:00"
first_seen_at: "2026-11-09T08:25:21+00:00"
updated_at: "2026-11-09T08:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124579", "first_seen_at": "2026-11-09T08:25:21+00:00"}, {"source": "analyst", "url": "https://github.com/aaPanel/BillionMail/releases", "first_seen_at": "2026-11-09T08:27:20+00:00", "cites": ["https://github.com/aaPanel/BillionMail/releases"]}]
exploit_sources: []
---

# aaPanel BillionMail: relay configuration API lets remote attackers inject commands

Link for people: https://infrastack.ai/live/CVE-2026-124579 (this .md is for agents)

BillionMail, an open-source email server panel from aaPanel, has an injection flaw in its Relay Configuration API through the helo_name argument in core/api/relay/v1/relay.go. A remote attacker can manipulate that argument to inject content, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BillionMail affected <= 4.9 fixed no fixed version listed

## How to check

Check your BillionMail version (4.9 and earlier are listed as affected by NVD); check whether the relay configuration API (core/api/relay/v1/relay.go) is reachable from untrusted networks and review relay HELO name settings for shell metacharacters. Unconfirmed: no vendor advisory found.

## Timeline

- 2026-11-09T08:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124579
- 2026-11-09T08:27:20+00:00 analyst https://github.com/aaPanel/BillionMail/releases — Only NVD/VulDB text available: affects BillionMail up to 4.9, helo_name in relay API, remote, PoC public per NVD (no link found), vendor did not respond. v4.9 is the latest release (GitHub releases page, no security fix noted), so no fixed version known. Auth requirement and code-execution outcome not confirmed (CVSS vector PR:L suggests low privileges needed; impact rated Low). Exa search out of credits, so no PoC or discussion found; nothing verified.

## Documents

- [mentions] BillionMail releases https://github.com/aaPanel/BillionMail/releases

## From the sources

A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_