--- id: "CVE-2026-126617" page: "https://infrastack.ai/live/CVE-2026-126617" kind: "vulnerability" aliases: ["CVE-2026-126617"] title: "hMailServer: SQL injection through recipient addresses lets mail senders alter database queries" severity: "high" cvss: 8.8 epss: null exploited: false status: "open" category: "package" products: [{"name": "hMailServer", "fixed": [], "affected": ">= 6.0.0-B1, <= 6.2.18 (per NVD; vendor says its 6.3.x fixes reach back to 6.0.0, so 6.3.x may also be affected)", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["hmailserver", "mail-server", "mariadb", "mysql", "package", "postgresql"] not_affected_if: ["patched-version", "sql-server-backend"] published_at: "2026-11-11T09:17:13+00:00" first_seen_at: "2026-11-11T09:26:48+00:00" updated_at: "2026-11-11T09:31:18+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126617", "first_seen_at": "2026-11-11T09:26:48+00:00"}, {"source": "analyst", "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8", "first_seen_at": "2026-11-11T09:31:18+00:00", "cites": ["https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8", "https://gitlab.com/hmailserver/hmailserver/-/wikis/Security-Policy"]}] exploit_sources: [] --- # hMailServer: SQL injection through recipient addresses lets mail senders alter database queries Link for people: https://infrastack.ai/live/CVE-2026-126617 (this .md is for agents) hMailServer's database layer builds SQL on MySQL, MariaDB and PostgreSQL by pasting parameter values into statement text, so a crafted value can break out of its quotes. A remote sender, even unauthenticated in some paths, can change the SQL the server runs under its database account. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:hMailServer affected >= 6.0.0-B1, <= 6.2.18 (per NVD; vendor says its 6.3.x fixes reach back to 6.0.0, so 6.3.x may also be affected) fixed no fixed version listed ## How to check - Find the installed version (Control Panel Server status, or hmailserver --version). NVD lists 6.0.0-B1 to 6.2.18; treat 6.3.x as unconfirmed until the vendor advisory says. - Check the database type in hMailServer.ini [Database]: MySQL, MariaDB and PostgreSQL are affected; SQL Server and SQL Server Compact are not. - Check whether greylisting or message indexing (IMAP SORT) is on; these open unauthenticated paths. Bounces and auto-replies to the envelope sender are a path regardless. ## Fix No fixed version confirmed for this CVE. The vendor supports only the 6.3 line and ships security fixes in the next release, with no backports. Run the latest, 6.3.8 (2 Nov 2026), and check the GitLab advisory for this CVE once published. Until then, on MySQL/MariaDB/PostgreSQL, restrict who can send mail and turn off greylisting and message indexing. ## Timeline - 2026-11-11T09:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126617 - 2026-11-11T09:31:18+00:00 analyst https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 — NVD text only; no vendor page naming this CVE found. 6.3.8 (2 Nov 2026) notes list its fixes and none is plainly this SQL flaw; 6.3.7/6.3.8 say they fix flaws reaching back to 6.0.0 but I could not tie this CVE to either. Fixed version unconfirmed; nothing verified. ## Documents - [mentions] hMailServer 6.3.8 release notes (GitLab) https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 - [mentions] hMailServer Security Policy https://gitlab.com/hmailserver/hmailserver/-/wikis/Security-Policy ## From the sources SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_