Exim Mail Server Directory Traversal and Command Execution Vulnerability Advisory

Vulnerability Overview Openwall has released a security fix for Exim addressing two security issues: 1. Directory Traversal Vulnerability (EXIM-Security-2026-06-22.1) - Type: Directory Traversal, Local - Component: Exim - Affected Versions: 4.88 (2017) through current 4.99.4 - Fixed Version: Exim 4.99.5 (exim-4.99.5) - Details: When the queue name is passed via command-line arguments in the Exim execution chain, it is possible to access files outside the spool area, which could lead to privilege escalation. 2. Command Execution Vulnerability (EXIM-Security-2026-06-22.3) - Type: Command Execution, via alternative privileges - Component: Exim - Affected Versions: 4.82 (2013) through current 4.99.4 - Fixed Version: Exim 4.99.5 (exim-4.99.5) - Details: Local users can utilize string expansions within files. Under certain Exim configurations, this may result in privilege escalation. Scope of Impact 1. Directory Traversal Vulnerability - Affected Configurations: All Exim installations; the attacker must have command-line access. 2. Command Execution Vulnerability - Affected Configurations: - Local user functionality implemented using the router - Pipe transports accessible by that router - Pipe transports with the option set - Pipe transports configured to run under a privileged user Remediation 1. Directory Traversal Vulnerability - Mitigations: None - Solution: Upgrade to Exim 4.99.5. The fix is located in the branch, tagged , signed by Jeremy Harris. - Download Links: - https://ftp.exim.org/pub/exim/exim4/ - https://code.exim.org/exim/exim/releases - Detailed Advisory: https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.1/ 2. Command Execution Vulnerability - Mitigations: Do not set on pipe transports. - Solution: Upgrade to Exim 4.99.5. The fix is located in the branch, tagged , signed by Jeremy Harris. - Download Links: - https://ftp.exim.org/pub/exim/exim4/ - https://code.exim.org/exim/exim/releases - Detailed Advisory: https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.3/ Timeline 2026-06-22 20:11 UTC: Report received 2026-06-23 11:57 UTC: Draft completed 2026-07-12 22:00 UTC: CVE assigned 2026-07-13 10:25 UTC: Advance notice sent to distros@openwall.org 2026-07-15 11:05 UTC: Fix branch and tag pushed to exim-distros 2026-07-22 14:00 UTC: Public release Additional Information Contact: Jeremy Harris Role: Exim Maintainer Mailing List: Provided by blists - more mailing lists Open Source Software Security Wiki: Contains information regarding mailing lists and formatting guidelines

Goal Reached Thanks to every supporter — we hit 100%!

Exim Mail Server Directory Traversal and Command Execution Vulnerability Advisory