{"id":"CVE-2026-126621","kind":"vulnerability","aliases":["CVE-2026-126621"],"related":[],"title":"hMailServer on Windows: TLS file names let local users swap certificates","description":"Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private keys and Diffie-Hellman parameters, a port's client-certificate CA file (from 6.2.19), the object store's CA file (from 6.3.4) and the ACME client's keys and certificates - as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF, and OpenSSL's file opening on Windows reads a name as UTF-8 first and opens the file at that reading when it is there, or creates it there when its folder is. When every byte of a configured name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9, which are U+00E9 in UTF-8 - the server used the file at that other name whenever one was there, which allows a local attacker who can create that file or its folder but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, to have a port that logs on by client certificate (from 6.2.25) accept certificates from a certificate authority of the attacker's own and so sign in over the network as any mailbox without its password; to have the server trust such an authority for its object store and, intercepting that connection, read and modify the messages it stores; to receive the private keys the ACME client writes, the key of a certificate issued for the server's names among them; or to keep TLS ports from starting. The configuration is not the default: by default these files have names in ASCII, client certificates are off on every port, and the object store and ACME are off. The Linux builds are not affected.","summary":"hMailServer on Windows passes non-ASCII TLS file names to OpenSSL in a way that lets a local attacker substitute their own certificate files. The attacker can then sign in as any mailbox, intercept object store traffic, or receive ACME-issued private keys.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":["6.3.8"],"affected":">= 6.0.0-B1, <= 6.3.7 (Windows)","ecosystem":"vendor"}],"ecosystems":[],"tags":["email","hmailserver","package","tls","windows"],"not_affected_if":["ascii-file-names","client-certs-off","default-config","linux"],"how_to_check":"- Windows only. Check the installed hMailServer version: affected is 6.0.0-B1 through 6.3.7; 6.3.8 is fixed. Linux builds are not affected.\n- Look in the hMailServer settings for TLS certificate, key, chain or dh2048.pem paths, client-certificate CA file (client certificates on a port, from 6.2.19, login by certificate from 6.2.25), MessageStoreObjectCaFile (from 6.3.4), or the ACME directory, containing any non-ASCII character.\n- Exposed only if a file name has non-ASCII characters, the feature is on, and a non-admin local user can create files or folders beside it (e.g. under ProgramData).","fix":"Upgrade to hMailServer 6.3.8 (released 2 November 2026). On Windows it reads the configured file or refuses a name it cannot hand to OpenSSL as written (error HM7536). Before upgrading, give TLS certificate/key files, dh2048.pem, client-certificate CA file, MessageStoreObjectCaFile and AcmeCertificateDirectory files, and the folders above them, ASCII names, or the port or feature using them will not start. Until then, use ASCII-only paths and restrict write access to the folders beside those files.","status":"open","published_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:25+00:00","updated_at":"2026-11-11T09:31:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T09:28:25Z","model":"claude-haiku-5-5","output":{"fix":"- hMailServer `6.3.8` or later is listed as the fixed range in the product data for this CVE; the sources do not state a specific fixed version beyond the affected range.","reach":"local","title":"hMailServer on Windows: TLS file names let local users swap certificates","impact":"high","summary":"hMailServer on Windows passes non-ASCII TLS file names to OpenSSL in a way that lets a local attacker substitute their own certificate files. The attacker can then sign in as any mailbox, intercept object store traffic, or receive ACME-issued private keys.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","windows","email","tls"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user signs in as any mailbox or reads and modifies stored mail","analyst_note":"Confirm the fixed version for hMailServer from the vendor advisory or NVD configuration data; the sources do not name one.","how_to_check":"- Check the installed hMailServer version against the affected range `6.0.0-B1` through `6.3.7` on Windows.\n- Look for non-ASCII characters in the names of TLS, client-certificate CA, object store CA, or ACME file paths in the hMailServer configuration.\n- Check whether client-certificate authentication on any port, the object store, or ACME is enabled.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","linux","ascii-file-names","client-certs-off"],"who_is_affected":"Only Windows installations of hMailServer in the affected range that use a non-default configuration: client-certificate authentication on a port, the object store CA, or ACME, with TLS file names containing non-ASCII characters. The attacker needs local file-system write access to a folder beside the configured file, such as a folder under ProgramData. Default configurations with ASCII file names and these features off are not affected, and Linux builds are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000854,"input_tokens":5016,"output_tokens":704,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version for hMailServer from the vendor advisory or NVD configuration data; the sources do not name one.","search":"'+00':141C,145C,197C,200C '+00e9':209C '-1':126C '-126621':14A,17A '-2026':13A,16A '-8':159C,193C,212C '1252':132C '6.0.0':72C '6.2.19':107C '6.2.25':270C '6.3.4':115C '6.3.7':75C 'a0':142C 'a9':201C,205C 'accept':271C 'acm':65B,118C,324C,373C 'acme-issu':64B 'administr':255C 'affect':381C 'allow':227C 'also':189C 'among':338C 'ascii':30B,188C,360C 'attack':43B,50B,230C,279C 'author':276C,302C 'b1':73C 'besid':251C 'build':378C 'byte':127C,182C,203C 'c3':198C,204C 'ca':104C,112C 'cannot':240C 'certif':11A,47B,89C,103C,123C,268C,272C,275C,331C,362C 'chain':90C 'chang':241C 'client':102C,119C,267C,325C,361C 'client-certif':101C 'code':130C,135C 'configur':185C,243C,348C 'connect':310C 'creat':173C,233C 'cve':12A,15A 'default':250C,352C,354C 'diffi':95C 'diffie-hellman':94C 'email':19B 'everi':181C,366C 'exampl':195C 'ff':146C 'file':5A,32B,48B,86C,105C,113C,150C,164C,217C,235C,253C,356C 'first':160C 'folder':178C,238C 'hand':78C 'hellman':96C 'hmailserv':1A,20B,24B,71C 'hmailserver':18A 'intercept':58B,308C 'issu':66B,332C 'keep':256C,342C 'key':68B,92C,121C,322C,328C 'latin':125C 'let':7A,40B 'linux':377C 'listen':88C 'local':8A,42B,229C 'log':264C 'mailbox':57B,291C 'messag':315C 'modifi':313C 'name':6A,33B,81C,156C,186C,221C,337C,358C 'network':288C 'non':29B 'non-ascii':28B 'object':59B,109C,305C,370C 'one':223C,244C 'open':151C,162C 'openssl':35B,79C,148C 'outsid':187C 'packag':21B 'page':131C,136C 'paramet':97C 'pass':27B 'password':294C 'port':99C,262C,344C,367C 'privat':67B,91C,321C 'programdata':258C 'progress':69C 'read':154C,167C,190C,311C 'receiv':63B,319C 'robot':70C 'server':214C,298C,335C 'sign':53B,284C 'start':346C 'store':60B,110C,306C,317C,371C 'substitut':44B 'swap':10A 'tls':4A,22B,31B,85C,343C 'traffic':61B 'trust':299C 'u':140C,144C,196C,199C,208C 'use':215C 'user':9A,247C 'utf':158C,192C,211C 'way':38B 'whenev':222C 'window':3A,23B,26B,77C,153C 'without':292C 'write':326C","nicknames":[],"mitigations":[],"who_affected":"Only Windows installations of hMailServer in the affected range that use a non-default configuration: client-certificate authentication on a port, the object store CA, or ACME, with TLS file names containing non-ASCII characters. The attacker needs local file-system write access to a folder beside the configured file, such as a folder under ProgramData. Default configurations with ASCII file names and these features off are not affected, and Linux builds are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T09:31:17Z","by":"analyst","doc":"https://www.hmailserver.co.uk/topic/28278/hmailserver-6.3.8-security-fixes-for-every-earlier-version-read-before-upgrading-and-a-helm-chart-that-starts-a-server","run_id":3528}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hmailserver"],"ptokens":["hmailserver"],"labels":["email","high","hmailserver","package","tls","windows"],"campaign_type":null,"search_a":"'-126621':14A,17A '-2026':13A,16A 'certif':11A 'cve':12A,15A 'file':5A 'hmailserv':1A 'hmailserver':18A 'let':7A 'local':8A 'name':6A 'swap':10A 'tls':4A 'user':9A 'window':3A","search_b":"'acm':65B 'acme-issu':64B 'ascii':30B 'attack':43B,50B 'certif':47B 'email':19B 'file':32B,48B 'hmailserv':20B,24B 'intercept':58B 'issu':66B 'key':68B 'let':40B 'local':42B 'mailbox':57B 'name':33B 'non':29B 'non-ascii':28B 'object':59B 'openssl':35B 'packag':21B 'pass':27B 'privat':67B 'receiv':63B 'sign':53B 'store':60B 'substitut':44B 'tls':22B,31B 'traffic':61B 'way':38B 'window':23B,26B","search_c":"'+00':141C,145C,197C,200C '+00e9':209C '-1':126C '-8':159C,193C,212C '1252':132C '6.0.0':72C '6.2.19':107C '6.2.25':270C '6.3.4':115C '6.3.7':75C 'a0':142C 'a9':201C,205C 'accept':271C 'acm':118C,324C,373C 'administr':255C 'affect':381C 'allow':227C 'also':189C 'among':338C 'ascii':188C,360C 'attack':230C,279C 'author':276C,302C 'b1':73C 'besid':251C 'build':378C 'byte':127C,182C,203C 'c3':198C,204C 'ca':104C,112C 'cannot':240C 'certif':89C,103C,123C,268C,272C,275C,331C,362C 'chain':90C 'chang':241C 'client':102C,119C,267C,325C,361C 'client-certif':101C 'code':130C,135C 'configur':185C,243C,348C 'connect':310C 'creat':173C,233C 'default':250C,352C,354C 'diffi':95C 'diffie-hellman':94C 'everi':181C,366C 'exampl':195C 'ff':146C 'file':86C,105C,113C,150C,164C,217C,235C,253C,356C 'first':160C 'folder':178C,238C 'hand':78C 'hellman':96C 'hmailserv':71C 'intercept':308C 'issu':332C 'keep':256C,342C 'key':92C,121C,322C,328C 'latin':125C 'linux':377C 'listen':88C 'local':229C 'log':264C 'mailbox':291C 'messag':315C 'modifi':313C 'name':81C,156C,186C,221C,337C,358C 'network':288C 'object':109C,305C,370C 'one':223C,244C 'open':151C,162C 'openssl':79C,148C 'outsid':187C 'page':131C,136C 'paramet':97C 'password':294C 'port':99C,262C,344C,367C 'privat':91C,321C 'programdata':258C 'progress':69C 'read':154C,167C,190C,311C 'receiv':319C 'robot':70C 'server':214C,298C,335C 'sign':284C 'start':346C 'store':110C,306C,317C,371C 'tls':85C,343C 'trust':299C 'u':140C,144C,196C,199C,208C 'use':215C 'user':247C 'utf':158C,192C,211C 'whenev':222C 'window':77C,153C 'without':292C 'write':326C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126621","severity":null,"published_at":"2026-11-11T09:17:14+00:00","modified_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126621:3528","url":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","severity":null,"published_at":"2026-11-11T09:31:17+00:00","modified_at":"2026-11-11T09:31:17+00:00","first_seen_at":"2026-11-11T09:31:17+00:00","fetched_at":"2026-11-11T09:31:17+00:00","note":"Fix 6.3.8 taken from maintainer release notes/announcement: work item 115 'On Windows the files the server hands to OpenSSL by name are read from the file configured, or refused' matches the CVE description; the notes do not print the CVE id (CVE requested), so the link is by description. Not exploited, no PoC found. Tier B, single pass.","cites":["https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","https://www.hmailserver.co.uk/topic/28278/hmailserver-6.3.8-security-fixes-for-every-earlier-version-read-before-upgrading-and-a-helm-chart-that-starts-a-server"]}],"documents":[{"id":124361,"url":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","title":"hMailServer 6.3.8 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":124366,"url":"https://www.hmailserver.co.uk/topic/28278/hmailserver-6.3.8-security-fixes-for-every-earlier-version-read-before-upgrading-and-a-helm-chart-that-starts-a-server","title":"hMailServer 6.3.8: security fixes (maintainer announcement)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}