Do Son 
TL;DR
The Exim team published advisory EXIM-Security-2026-06-22.1 on July 22, 2026. It describes an Exim vulnerability that lets a local attacker read files outside the mail spool. The bug can lead to privilege escalation, and version 4.99.5 fixes it.
Why it matters
Exim moves mail on a large share of the internet’s servers. A local flaw on such a widespread agent has broad reach. This directory traversal turns command-line access into a possible route to higher privileges.
How the attack works
The flaw sits in Exim’s queue-name handling. Certain command-line arguments pass a queue name through an execution chain. An attacker abuses those arguments to reach files outside the spool area.
The advisory states the issue plainly: “files outside the spool area can be accessed. This can be used for a privilege escalation.” To reach the vulnerable code, though, the attacker first needs command-line access on the host.
Affected versions
The Exim vulnerability affects versions from 4.88, released in 2017, up to and including 4.99.4. The development master branch was affected too. The full official Exim security advisory lists the exact range.
Exploitation status
No in-the-wild exploitation has been confirmed. Likewise, the advisory lists no public proof-of-concept code.
Patch and mitigation
The team offers no workaround, so upgrading is the only fix. Move to Exim 4.99.5 as soon as you can. The patch limits the affected options to already-privileged users and restricts the characters allowed in queue names.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
