# CVE-2026-126617: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in hMailServer

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected.

## Remediation

- fix: Upgrade to hMailServer 6.2.19 or later, which substitutes parameters in a single pass that never re-examines a value already written into the statement, and gives each parameter a name no other parameter's name and ordinal can form. There is no complete workaround for earlier versions on MySQL/MariaDB or PostgreSQL, since the recipient row is written for every queued message; keeping message indexing (MessageIndexing) and greylisting off, as they are by default, removes those two paths only. SQL Server and SQL Server Compact installations need no action for this issue. (source: CNA: GitLab)

## Affected products and versions

- Progressive Robot Ltd / hMailServer: ≥ 6.0.0-B1; ≤ 6.2.18 (affected, semver). Source: CNA: GitLab

## Severity and prioritization

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitLab

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-89

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://gitlab.com/hmailserver/hmailserver/-/work_items/101 (CNA: GitLab)

- https://gitlab.com/hmailserver/hmailserver/-/releases/v6.2.19 (CNA: GitLab)

## Provenance

- CNA: GitLab: https://www.cve.org/CVERecord?id=CVE-2026-126617; retrieved 2026-11-11; source updated 2026-11-11

Revision: 433257f473de6de15ac171b958ea267e708db5c6ad91da24d07c49af30cc17f7

Canonical: https://y2.dev/cve/CVE-2026-126617

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.