# CVE-2026-126612: Improper Link Resolution Before File Access ('Link Following') in hMailServer

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.

## Remediation

- fix: Upgrade to hMailServer 6.3.8, whose setup holds every folder from the root of the volume down to the program folder, Bin and ControlPanel open and, before anything changes, refuses with exit code 7 a junction, a symbolic link or a mount point on the way that anybody but SYSTEM, the Administrators and TrustedInstaller owns, may change or may remove - a junction made at a drive's root and left with the permissions the root hands down among them - and a folder on the way that another account may rename or remove, or empty, naming each with the icacls that deals with it. Until then, install hMailServer under Program Files, or at a path with no link on it below folders that only administrators may change. For a link that is meant to be on the path, make it the administrators' alone from an elevated Command Prompt - icacls "<link>" /L /setowner *S-1-5-32-544, then icacls "<link>" /L /inheritance:r /grant:r *S-1-5-18:F *S-1-5-32-544:F *S-1-5-32-545:RX - and check where it leads (dir /al of the folder that holds it); make the Administrators the owner of each folder above the program folder that other accounts may change, and take away their right to change it; then restart Windows. Where another account owned or could change such a link or folder while the installation was there, reinstall into a new folder as the hMailServer documentation, ServiceAccount.md, "Reinstalling into a new folder", says. (source: CNA: GitLab)

## Affected products and versions

- Progressive Robot Ltd / hMailServer: ≥ 6.0.0; ≤ 6.3.7 (affected, semver). Source: CNA: GitLab

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitLab

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-59

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://gitlab.com/hmailserver/hmailserver/-/work_items/78 (CNA: GitLab)

- https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 (CNA: GitLab)

- https://www.cve.org/CVERecord?id=CVE-2026-107571 (CNA: GitLab)

## Provenance

- CNA: GitLab: https://www.cve.org/CVERecord?id=CVE-2026-126612; retrieved 2026-11-11; source updated 2026-11-11

Revision: cad5cb04035846b136ae8fa80f95894be4d770e38d555e8048333481c9bb2785

Canonical: https://y2.dev/cve/CVE-2026-126612

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.