CVE-2026-100741— hMailServer 动态代码执行注入漏洞
一分钟漏洞结论
影响对象
Progressive Robot Ltd hMailServer
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
这段漏洞描述主要涉及 hMailServer 中的代码注入漏洞。以下是该漏洞描述的中文翻译： Progressive Robot Ltd 公司旗下的 hMailServer（Windows 平台，版本 6.0.0 至 6.3.3）中的 JScript 事件脚本调度器存在 Eval 注入漏洞。攻击者可以通过在登录请求（包括 SMTP AUTH、POP3 或 IMAP）中发送包含“反斜杠后跟单引号”的密码，对现有且处于活跃状态的账户进行身份验证，从而在远程、无需认证的情况下，以服务账户权限在 hMailServer 服
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-100741 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
来源: CVE Program / CVE List V5
Vulnerability Description
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a password containing a backslash followed by an apostrophe, sent in any logon (SMTP AUTH, POP3, IMAP) that names an existing, active account. Exploitation requires a non-default configuration: event scripting enabled (off by default), the script language set to JScript (the default is VBScript), and an OnClientValidatePassword handler defined in the event script. The server wrote event values into the handler call as JScript string literals, escaping the apostrophe but not the backslash, so such a value closes the literal and the rest of it is parsed as script. The same flaw is reachable by a remote POP3 server through the message UID it returns, where an OnExternalAccountDownload handler is defined, and by a remote SMTP server through the error reply it rejects a delivery with, where an OnDeliveryFailed handler is defined. Before 6.2.25 the injected script can create any COM object, and from 6.2.25 it can with the default ScriptAllowedObjects value of '*'; WScript.Shell among them gives command execution as the service account. VBScript event scripts and the Linux builds of Progressive Robot Ltd's hMailServer are not affected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 ~ 6.3.4 | - |
|
二、漏洞 CVE-2026-100741 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-100741 的情报信息
请登录查看更多情报信息。
CVE-2026-100741 其他参考 (2)
IV. Related Vulnerabilities
V. Comments for CVE-2026-100741
暂无评论