Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107571— Incorrect Default Permissions in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.0.0 至 6.3.6 的 Windows 安装程序存在默认权限配置不当的漏洞。当该产品被安装到权限继承自可写父目录的文件夹中（例如磁盘根目录）时，本地已认证用户可利用该漏洞以邮件服务器的高权限账户身份执行代码。安装程序将服务器程序放置于程序文件夹的 Bin 子目录中，且未为程序文件夹或 Bin 子目录设置任何专属权限，导致它们继承父目录的权限。在默认安装位置（Program Files）下，普通用户仅拥有读取和执行权限，因此配置不受影响；然而，安装程

CVSS 7.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Progressive Robot Ltd hMailServer 6.0.0≤ 6.3.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107571

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect Default Permissions in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
缺省权限不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.0.0 ~ 6.3.6 -

II. Public POCs for CVE-2026-107571

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107571

请登录查看更多情报信息。

Other References for CVE-2026-107571 (2)

Same Patch Batch · Progressive Robot Ltd · 2026-10-19 · 5 CVEs total

CVE-2026-107567 7.5 HIGH Use of Less Trusted Source in hMailServer
CVE-2026-107569 7.5 HIGH Unchecked Input for Loop Condition in hMailServer
CVE-2026-107568 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-107566 6.5 MEDIUM Missing Authorization in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-276

V. Comments for CVE-2026-107571

No comments yet

Leave a comment