CVE-2026-126612— hMailServer 文件访问前链接解析不当漏洞
一分钟漏洞结论
影响对象
Progressive Robot Ltd hMailServer
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Progressive Robot hMailServer 6.0.0 至 6.3.7 版本 Windows 安装程序中存在链接解析不当的漏洞。当程序文件夹的路径经过由本地已认证用户控制、或任何用户均可修改的联接点（junction）、符号链接或挂载点时（例如位于驱动器根目录的联接点，该联接点继承根目录权限；或经过任何用户均可重命名的文件夹），本地已认证用户可借此以邮件服务器服务账户或管理员身份执行代码。 安装程序在安装软件时，未首先检查该链接的控制权归属，也未验证程序文件夹上方的文件夹是否可被重命名，便直接通过此
可能的 ATT&CK 技术 3 AI
T1055.012 · Process Hollowing T1059.001 · PowerShell T1548.001 · Setuid and Setgid
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-126612 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Improper Link Resolution Before File Access ('Link Following') in hMailServer
来源: CVE Program / CVE List V5
Vulnerability Description
Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 ~ 6.3.7 | - |
|
二、漏洞 CVE-2026-126612 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-126612 的情报信息
请登录查看更多情报信息。
CVE-2026-126612 厂商页面 (1)
CVE-2026-126612 其他参考 (2)
同批安全公告 · Progressive Robot Ltd · 2026-11-11 · 共 18 条
| CVE-2026-126617 | 8.8 HIGH | hMailServer SQL 注入漏洞 |
| CVE-2026-126607 | 7.8 HIGH | hMailServer 搜索路径元素控制缺失漏洞 |
| CVE-2026-126613 | 7.5 HIGH | hMailServer 资源分配无限制漏洞 |
| CVE-2026-126621 | 7.5 HIGH | hMailServer 证书验证不当漏洞 |
| CVE-2026-126623 | 7.5 HIGH | hMailServer 低效算法复杂度漏洞 |
| CVE-2026-126609 | 7.5 HIGH | hMailServer 证书验证不当漏洞 |
| CVE-2026-126610 | 7.4 HIGH | hMailServer 证书验证不当漏洞 |
| CVE-2026-126622 | 7.3 HIGH | hMailServer 默认权限配置错误漏洞 |
| CVE-2026-126624 | 7.3 HIGH | hMailServer 未验证所有权漏洞 |
| CVE-2026-126611 | 7.0 HIGH | hMailServer 证书验证不当漏洞 |
| CVE-2026-126625 | 6.7 MEDIUM | hMailServer 默认权限配置错误漏洞 |
| CVE-2026-126618 | 5.3 MEDIUM | hMailServer 身份验证尝试限制不当漏洞 |
| CVE-2026-126626 | 5.3 MEDIUM | hMailServer 账户锁定机制过于严格漏洞 |
| CVE-2026-126615 | 5.3 MEDIUM | hMailServer 别名身份验证绕过漏洞 |
| CVE-2026-126614 | 5.3 MEDIUM | hMailServer 身份验证尝试限制不当漏洞 |
| CVE-2026-126616 | 5.3 MEDIUM | hMailServer 身份验证尝试限制不当漏洞 |
| CVE-2026-126619 | 4.8 MEDIUM | hMailServer 输入解析错误漏洞 |