Description

The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-08T11:16:43.870Z",
  "pubdate": "2026-10-08T11:16:43.870Z",
  "executiveSummary": "Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a critical security flaw in the live-update apply helper (hmailserver-update) that allows local privilege escalation to root.\nThe vulnerability stems from improper trust boundaries where an unprivileged service account can influence privileged operations performed by the update helper.\nBy manipulating request files, an attacker who has already compromised the hmailserver service account can trigger arbitrary code execution with root privileges.\nThis vulnerability is present by default in .deb and .rpm package installations where the live update's path unit is active.\nThe attack is limited to local exploitation, requiring prior compromise of the hmailserver service account, but results in a complete system compromise once elevated to root.\nThe flaw highlights a failure in input sanitization and secure process execution practices within the update mechanism, creating a path for lateral movement from service-level access to full administrative control of the Linux host.",
  "technicalDetails": "The root cause of this vulnerability is an insecure design in the hmailserver-update helper, which operates with root privileges but consumes user-controlled input to make sensitive execution decisions.\nSpecifically, the helper processes request files that are writable by the unprivileged hmailserver service account. The helper blindly trusts fields within these files to define parameters for subsequent system operations.\nThe vulnerability is triggered because the hmailserver-update utility reads the path to the program used to verify an AppImage update's signature, as well as the identification of the systemd unit to be stopped, directly from the service-account-controlled request file.\nAn attacker who has gained execution as the hmailserver service account (e.g., via a separate application-level vulnerability) can craft a malicious request file. By injecting an arbitrary binary path into the signature verification field, the attacker can force the root-privileged helper to execute malicious code.\nFurthermore, by manipulating the specified systemd unit, the attacker may influence service management operations as part of the exploit chain.\nThe attack flow follows these steps: 1. The attacker gains initial access to the system as the hmailserver user. 2. The attacker creates or modifies a request file utilized by the hmailserver-update helper. 3. The attacker populates the fields in this request file with paths to malicious payloads or scripts. 4. The attacker triggers the hmailserver-update utility. 5. The utility runs with root privileges, reads the attacker-controlled request file, and subsequently executes the malicious payload identified in the request file. 6. The payload executes with root privileges, granting the attacker full control over the underlying Linux installation.\nThis vulnerability is effective on any Linux installation where the project's default packaging is used, as the live update path unit is enabled by default. Because the update helper acts as a privileged bridge between the unprivileged service account and system-level management, it circumvents standard Unix permission models, effectively turning a service-account compromise into a full root-level compromise."
}