{"id":"CVE-2026-126617","kind":"vulnerability","aliases":["CVE-2026-126617"],"related":[],"title":"hMailServer: SQL injection through recipient addresses lets mail senders alter database queries","description":"SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected.","summary":"hMailServer's database layer builds SQL on MySQL, MariaDB and PostgreSQL by pasting parameter values into statement text, so a crafted value can break out of its quotes. A remote sender, even unauthenticated in some paths, can change the SQL the server runs under its database account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":[],"affected":">= 6.0.0-B1, <= 6.2.18 (per NVD; vendor says its 6.3.x fixes reach back to 6.0.0, so 6.3.x may also be affected)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hmailserver","mail-server","mariadb","mysql","package","postgresql"],"not_affected_if":["patched-version","sql-server-backend"],"how_to_check":"- Find the installed version (Control Panel Server status, or hmailserver --version). NVD lists 6.0.0-B1 to 6.2.18; treat 6.3.x as unconfirmed until the vendor advisory says.\n- Check the database type in hMailServer.ini [Database]: MySQL, MariaDB and PostgreSQL are affected; SQL Server and SQL Server Compact are not.\n- Check whether greylisting or message indexing (IMAP SORT) is on; these open unauthenticated paths. Bounces and auto-replies to the envelope sender are a path regardless.","fix":"No fixed version confirmed for this CVE. The vendor supports only the 6.3 line and ships security fixes in the next release, with no backports. Run the latest, 6.3.8 (2 Nov 2026), and check the GitLab advisory for this CVE once published. Until then, on MySQL/MariaDB/PostgreSQL, restrict who can send mail and turn off greylisting and message indexing.","status":"open","published_at":"2026-11-11T09:17:13+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:19+00:00","updated_at":"2026-11-11T09:31:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T09:28:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"hMailServer: SQL injection through recipient addresses lets mail senders alter database queries","impact":"high","summary":"hMailServer's database layer builds SQL on MySQL, MariaDB and PostgreSQL by pasting parameter values into statement text, so a crafted value can break out of its quotes. A remote sender, even unauthenticated in some paths, can change the SQL the server runs under its database account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","mail-server","mysql","mariadb","postgresql"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker alters database queries and may run further statements on PostgreSQL","analyst_note":"Find the fixed version in the hMailServer release notes or NVD entry; the sources here give no fixed version.","how_to_check":"- Check the installed hMailServer version and whether it falls between `6.0.0-B1` and `6.2.18`\n- Check whether the database backend is MySQL, MariaDB or PostgreSQL rather than SQL Server\n- Check whether greylisting or message indexing is enabled, since those open unauthenticated paths","plain_action":"","product_name":"hMailServer","needs_analyst":true,"not_affected_if":["sql-server-backend","patched-version"],"who_is_affected":"Mail servers running hMailServer 6.0.0-B1 through 6.2.18 on MySQL, MariaDB or PostgreSQL are exposed, because the flaw is in how the server writes recipient rows to its database. An authenticated user who can send mail reaches it in the default configuration, and unauthenticated senders reach it through bounce or auto-reply messages, and through greylisting or IMAP SORT indexing when those are enabled. SQL Server and SQL Server Compact installs are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000846,"input_tokens":4971,"output_tokens":698,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version in the hMailServer release notes or NVD entry; the sources here give no fixed version.","search":"'-126617':15A,18A '-2026':14A,17A '6.0.0':85C '6.2.18':88C 'account':74B,302C 'address':6A,198C,218C,269C 'affect':354C 'allow':96C 'alter':10A,101C,291C 'attack':99C 'authent':206C 'automat':248C 'b1':86C 'bound':114C,351C 'break':51B 'build':32B 'call':307C,331C 'carri':194C,282C 'chang':65B,333C 'choos':221C 'client':306C 'compact':347C 'configur':204C 'confin':335C 'craft':48B 'cve':13A,16A 'databas':11A,30B,73B,79C,301C 'default':203C,262C 'deliveri':243C 'earli':171C 'enabl':257C 'end':168C 'engin':110C 'envelop':238C,268C 'even':59B 'everi':309C 'failur':244C 'field':285C 'follow':320C 'four':283C 'generatefromcommand':116C 'given':316C 'greylist':252C,265C 'header':284C 'hmailserv':1A,20B,28B,84C 'hmailserver':19A 'hold':143C 'imap':279C 'index':255C 'inject':3A,76C 'insid':156C 'later':161C,175C 'layer':31B,80C 'let':7A 'liter':128C,170C 'mail':8A,22B,211C 'mail-serv':21B 'mariadb':24B,36B 'may':209C 'messag':193C,232C,254C,273C,289C 'metadata':274C 'mysql':25B,35B 'mysql/mariadb':93C,324C 'name':145C,154C 'notic':245C 'one':326C 'packag':26B 'paramet':41B,111C,139C,148C,349C 'past':40B 'path':63B 'per':138C,330C 'place':173C 'postgresql':27B,38B,95C,304C 'privileg':296C 'progress':82C 'queri':12A 'queu':192C 'quot':55B,127C,166C 'reach':212C,226C 'receiv':288C 'recipi':5A,189C,196C 'record':266C 'remot':57B,98C,223C 'replac':133C,155C 'repli':249C 'robot':83C 'row':183C 'run':70B,106C,293C,308C,329C 'send':210C,215C,235C 'sender':9A,58B,225C,239C 'separ':131C 'server':23B,69B,91C,105C,185C,234C,276C,299C,343C,346C 'sort':280C 'sql':2A,33B,67B,75C,102C,181C,342C,345C 'sqlstatement':115C 'statement':44B,103C,122C,179C,229C,292C,310C,318C,327C,338C 'store':277C 'string':132C 'substitut':149C 'text':45B,124C,137C,313C 'twice':199C 'two':109C 'unauthent':60B,224C 'use':92C 'user':207C 'valu':42B,49B,119C,142C,158C,162C,176C 'whole':136C 'whose':305C 'write':186C 'wrote':117C","nicknames":[],"mitigations":[],"who_affected":"Mail servers running hMailServer 6.0.0-B1 through 6.2.18 on MySQL, MariaDB or PostgreSQL are exposed, because the flaw is in how the server writes recipient rows to its database. An authenticated user who can send mail reaches it in the default configuration, and unauthenticated senders reach it through bounce or auto-reply messages, and through greylisting or IMAP SORT indexing when those are enabled. SQL Server and SQL Server Compact installs are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["hmailserver"],"ptokens":["hmailserver"],"labels":["high","hmailserver","mailserver","mariadb","mysql","package","postgresql","vendor"],"campaign_type":null,"search_a":"'-126617':15A,18A '-2026':14A,17A 'address':6A 'alter':10A 'cve':13A,16A 'databas':11A 'hmailserv':1A 'hmailserver':19A 'inject':3A 'let':7A 'mail':8A 'queri':12A 'recipi':5A 'sender':9A 'sql':2A","search_b":"'account':74B 'break':51B 'build':32B 'chang':65B 'craft':48B 'databas':30B,73B 'even':59B 'hmailserv':20B,28B 'layer':31B 'mail':22B 'mail-serv':21B 'mariadb':24B,36B 'mysql':25B,35B 'packag':26B 'paramet':41B 'past':40B 'path':63B 'postgresql':27B,38B 'quot':55B 'remot':57B 'run':70B 'sender':58B 'server':23B,69B 'sql':33B,67B 'statement':44B 'text':45B 'unauthent':60B 'valu':42B,49B","search_c":"'6.0.0':85C '6.2.18':88C 'account':302C 'address':198C,218C,269C 'affect':354C 'allow':96C 'alter':101C,291C 'attack':99C 'authent':206C 'automat':248C 'b1':86C 'bound':114C,351C 'call':307C,331C 'carri':194C,282C 'chang':333C 'choos':221C 'client':306C 'compact':347C 'configur':204C 'confin':335C 'databas':79C,301C 'default':203C,262C 'deliveri':243C 'earli':171C 'enabl':257C 'end':168C 'engin':110C 'envelop':238C,268C 'everi':309C 'failur':244C 'field':285C 'follow':320C 'four':283C 'generatefromcommand':116C 'given':316C 'greylist':252C,265C 'header':284C 'hmailserv':84C 'hold':143C 'imap':279C 'index':255C 'inject':76C 'insid':156C 'later':161C,175C 'layer':80C 'liter':128C,170C 'mail':211C 'may':209C 'messag':193C,232C,254C,273C,289C 'metadata':274C 'mysql/mariadb':93C,324C 'name':145C,154C 'notic':245C 'one':326C 'paramet':111C,139C,148C,349C 'per':138C,330C 'place':173C 'postgresql':95C,304C 'privileg':296C 'progress':82C 'queu':192C 'quot':127C,166C 'reach':212C,226C 'receiv':288C 'recipi':189C,196C 'record':266C 'remot':98C,223C 'replac':133C,155C 'repli':249C 'robot':83C 'row':183C 'run':106C,293C,308C,329C 'send':210C,215C,235C 'sender':225C,239C 'separ':131C 'server':91C,105C,185C,234C,276C,299C,343C,346C 'sort':280C 'sql':75C,102C,181C,342C,345C 'sqlstatement':115C 'statement':103C,122C,179C,229C,292C,310C,318C,327C,338C 'store':277C 'string':132C 'substitut':149C 'text':124C,137C,313C 'twice':199C 'two':109C 'unauthent':224C 'use':92C 'user':207C 'valu':119C,142C,158C,162C,176C 'whole':136C 'whose':305C 'write':186C 'wrote':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126617","severity":null,"published_at":"2026-11-11T09:17:13+00:00","modified_at":"2026-11-11T09:17:13+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126617:3529","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8","severity":null,"published_at":"2026-11-11T09:31:18+00:00","modified_at":"2026-11-11T09:31:18+00:00","first_seen_at":"2026-11-11T09:31:18+00:00","fetched_at":"2026-11-11T09:31:18+00:00","note":"NVD text only; no vendor page naming this CVE found. 6.3.8 (2 Nov 2026) notes list its fixes and none is plainly this SQL flaw; 6.3.7/6.3.8 say they fix flaws reaching back to 6.0.0 but I could not tie this CVE to either. Fixed version unconfirmed; nothing verified.","cites":["https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8","https://gitlab.com/hmailserver/hmailserver/-/wikis/Security-Policy"]}],"documents":[{"id":124359,"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8","title":"hMailServer 6.3.8 release notes (GitLab)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":124368,"url":"https://gitlab.com/hmailserver/hmailserver/-/wikis/Security-Policy","title":"hMailServer Security Policy","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}