This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Exim fixes 2 vulnerabilities
Exim version 4.99.5 fixes 2 vulnerabilities [1].
A local attacker with command-line access can, due to insufficient validation of the passed queue name argument, perform a directory traversal attack and access files outside the spool directory, which may lead to privilege escalation [1].
The vulnerability is present in product:
- Exim; >=4.88, < 4.99.5
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-66140 at cve.org, NVD
- CWE-24: Path Traversal: '../filedir' at cwe.mitre.org
The vulnerability was publicly disclosed 22. 7. 2026.
A local authenticated attacker who owns a ".forward" file containing a string expansion can escalate their privileges if Exim uses a pipe transport that runs as a privileged user and has the "force_command" option set [1].
The vulnerability is present in product:
- Exim; >=4.88, < 4.99.5
CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-66141 at cve.org, NVD
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere at cwe.mitre.org
The vulnerability was publicly disclosed 22. 7. 2026.
By CESNET, z.s.p.o. Pavla Hlučková on 24. 7. 2026.