CVE-2026-66140
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
Risk Assessment
An attacker could access files outside the spool area, potentially leading to privilege escalation and takeover of the mail system.
Recommendation
Update Exim to version 4.99.5 or later, which includes a fix for this issue.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
- CVE-2026-48840Medium
Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.
- CVE-1999-0971High
Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.
Original NVD description (English source)
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.