Exim Directory Traversal Flaw Enables Privilege Escalation, Fixed in 4.99.5

TL;DR

The Exim team published advisory EXIM-Security-2026-06-22.1 on July 22, 2026. It describes an Exim vulnerability that lets a local attacker read files outside the mail spool. The bug can lead to privilege escalation, and version 4.99.5 fixes it.

Why it matters

Exim moves mail on a large share of the internet’s servers. A local flaw on such a widespread agent has broad reach. This directory traversal turns command-line access into a possible route to higher privileges.

How the attack works

The flaw sits in Exim’s queue-name handling. Certain command-line arguments pass a queue name through an execution chain. An attacker abuses those arguments to reach files outside the spool area.

The advisory states the issue plainly: “files outside the spool area can be accessed. This can be used for a privilege escalation.” To reach the vulnerable code, though, the attacker first needs command-line access on the host.

Affected versions

The Exim vulnerability affects versions from 4.88, released in 2017, up to and including 4.99.4. The development master branch was affected too. The full official Exim security advisory lists the exact range.

Exploitation status

No in-the-wild exploitation has been confirmed. Likewise, the advisory lists no public proof-of-concept code.

Patch and mitigation

The team offers no workaround, so upgrading is the only fix. Move to Exim 4.99.5 as soon as you can. The patch limits the affected options to already-privileged users and restricts the characters allowed in queue names.

Update: CVE Identifiers Assigned

The two flaws behind advisory EXIM-Security-2026-06-22.1 now carry official CVE identifiers. Both are fixed in Exim 4.99.5.

CVE-2026-66140 (CVSS 8.4)

This is the directory traversal covered above. Exim before 4.99.5 mishandles arguments related to the queue name. As a result, an attacker can reach files outside the spool area and escalate privileges.

CVE-2026-66141 (CVSS 7.4)

The advisory also covers a second issue. Exim before 4.99.5 mishandles force_command for a pipe transport. Consequently, a crafted .forward file opens a path to privilege escalation.

The higher score on CVE-2026-66140 reflects its broader impact. Still, both bugs share the same remedy. Therefore, administrators should move to 4.99.5 rather than patch selectively.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.