{"id":"CVE-2026-66140","aliases":["ALPINE-CVE-2026-66140","CLSA-2026-1787225012","CLSA-2026-1787230875","CLSA-2026-1787315165","CLSA-2026-1787322589","CLSA-2026-1787328725","CLSA-2026-1787398969","CLSA-2026-1787664471","CLSA-2026-1788259973","CLSA-2026-1788260209","DEBIAN-CVE-2026-66140","EUVD-2026-48478","GHSA-5qxf-w5v2-m3rg","ROOT-OS-DEBIAN-11-CVE-2026-66140","ROOT-OS-DEBIAN-12-CVE-2026-66140","UBUNTU-CVE-2026-66140"],"status":"published","title":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and...","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00386,"percentile":0.33048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-24"],"published":"2026-07-24T04:32:08Z","modified":"2026-11-03T06:33:03Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"exim","fixed_in":["4.98.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.99.4-2"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"exim4","fixed_in":["4.94.2-7+deb11u6.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-exim4","fixed_in":["4.94.2-7+deb11u6.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u10.aikido.2","4.96-15+deb12u10.aikido.3","4.96-15+deb12u10.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-exim4","fixed_in":["4.96-15+deb12u10.aikido.2","4.96-15+deb12u10.aikido.3","4.96-15+deb12u10.aikido.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.5-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1","4.100.1-1~bpo13+1","4.100.1-2","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.96-15","4.96-15+deb12u1","4.96-15+deb12u10","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8","4.96-15+deb12u9","4.96-16","4.96-17","4.96-18","4.96-19","4.96-20","4.96-21","4.96-22","4.97-1","4.97-1~hurd.2","4.97-2","4.97-3","4.97-4","4.97-5","4.97-6","4.97-7","4.97-8","4.97-8~bpo12+1","4.97~RC0-1","4.97~RC0-2","4.97~RC0-3","4.97~RC1-1","4.97~RC1-2","4.97~RC2-1","4.97~RC2-2","4.97~RC3-1","4.98-1","4.98-1~bpo12+1","4.98-2","4.98-2~bpo12+1","4.98-3","4.98-3+hurd.1","4.98-3~bpo12+1","4.98-4","4.98.1-1","4.98.1-2","4.98.1-2~bpo12+1","4.98.2-1","4.98.2-1+hurd.1","4.98.2-1~bpo12+1","4.98.2-2","4.98~RC0-1","4.98~RC1-1","4.98~RC2-1","4.98~RC3-1","4.98~RC3-2","4.98~RC3-2~bpo12+1","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u4"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1","4.98.2-1+deb13u2","4.98.2-1+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.4-2"}]}],"versions":["4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Root:Debian:11","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.94.2-7+deb11u6.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.94.2-7+deb11u6.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u10.aikido.2"},{"fixed":"4.96-15+deb12u10.aikido.3"},{"fixed":"4.96-15+deb12u10.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u10.aikido.2"},{"fixed":"4.96-15+deb12u10.aikido.3"},{"fixed":"4.96-15+deb12u10.aikido.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12","4.93-13ubuntu1.12+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.11"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.7"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.4"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3"]}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://openwall.com/lists/oss-security/2026/07/22/9","tags":["Mailing List","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66140","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5qxf-w5v2-m3rg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-66140","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1787225012.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66141","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1787230875.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787315165.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1787322589.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1787328725.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787398969.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787664471.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1788259973.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1788260209.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66140","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-66140","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66140","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/22/9","tags":["report"]},{"url":"https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.1/EXIM-Security-2026-06-22.1.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8590-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-66140","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T04:32:08.764Z","modified":"2026-07-24T12:25:04.081Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:20:13.272106Z"}],"euvd":[{"id":"EUVD-2026-48478","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T04:32:08Z","modified":"2026-07-24T12:25:04Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:41.195396Z"}],"ghsa":[{"id":"GHSA-5qxf-w5v2-m3rg","title":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and...","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T06:34:11Z","modified":"2026-07-24T06:34:11Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T15:09:45.375488Z"}],"nvd":[{"id":"CVE-2026-66140","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T05:16:49.747Z","modified":"2026-08-17T19:04:18.053Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"ALPINE-CVE-2026-66140","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T05:16:49.747Z","modified":"2026-11-03T06:33:03.890135101Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"DEBIAN-CVE-2026-66140","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T05:16:49.747Z","modified":"2026-10-01T03:03:38.997731792Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"UBUNTU-CVE-2026-66140","description":"Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.","status":"published","published":"2026-07-24T05:16:00Z","modified":"2026-08-19T13:32:33.302625042Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1787225012","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-66140: restrict named-queue names and require admin for -MC*\n  command-line options\n- CVE-2026-66141: do not expand local_part in a pipe transport under\n  force_command","status":"published","published":"2026-08-20T11:23:43Z","modified":"2026-10-26T09:31:55.016403348Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787230875","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-66140: restrict named-queue names and require admin for -MC*\n  command-line options\n- CVE-2026-66141: do not expand local_part in a pipe transport under\n  force_command","status":"published","published":"2026-08-22T10:43:04Z","modified":"2026-10-26T09:31:40.689774909Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787315165","title":"exim: Fix of 2 CVEs","description":"- Rebuilt with rebrand to TuxCare ELS\n- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for\n  named-queues\n- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a\n  .forward file in a pipe transport under force_command","status":"published","published":"2026-08-21T12:26:17Z","modified":"2026-10-26T09:31:30.260031049Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787322589","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-66140: fix directory traversal via mishandled queue-name arguments (local privilege escalation)\n- CVE-2026-66141: fix .forward privilege escalation via mishandled force_command for a pipe transport","status":"published","published":"2026-08-21T14:30:01Z","modified":"2026-10-26T09:31:42.512269095Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787328725","title":"Fix CVE(s): CVE-2026-66140, CVE-2026-66141","description":"   * SECURITY UPDATE: directory traversal outside the spool area through\n     mishandled named-queue arguments, leading to privilege escalation\n     - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and\n       apply it to both command-line sources of a queue name, -MCG \u003cname\u003e\n       and -q[f][f][l]G\u003cname\u003e, rejecting a name that contains '/', is longer\n       than 32 characters, or collides with one of the reserved spool\n       subdirectories input, db, msglog and scan; mark -MC and every -MCx\n       argument as admin-only and refuse them for a non-admin caller\n     - CVE-2026-66140\n   * SECURITY UPDATE: .forward privilege escalation caused by expansion of\n     the pipe command under force_command\n     - debian/patches/CVE-2026-66141.patch: stop passing addr-\u003elocal_part\n       through expand_string() in the $address_pipe special case of a pipe\n       transport that has force_command set, so command text supplied by a\n       local user in a .forward file is only dequoted and split into\n       arguments instead of being evaluated with the transport's privileges\n     - CVE-2026-66141","status":"published","published":"2026-08-21T16:12:18Z","modified":"2026-10-26T09:31:40.157252135Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787398969","title":"exim: Fix of 2 CVEs","description":"- Rebuilt with rebrand to TuxCare ELS\n- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for\n  named-queues\n- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a\n  .forward file in a pipe transport under force_command","status":"published","published":"2026-08-22T11:43:00Z","modified":"2026-10-26T09:30:37.849395987Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787664471","title":"Fix CVE(s): CVE-2026-66140, CVE-2026-66141","description":"   * SECURITY UPDATE: directory traversal via named-queue arguments\n     - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply\n       it to the -MCG and -q[f][f][l]G\u003cname\u003e command-line queue names, rejecting\n       names containing '/', longer than 32 characters, or colliding with the\n       reserved spool subdirectories; restrict -MC and all -MCx arguments to\n       admin users.\n     - CVE-2026-66140\n   * SECURITY UPDATE: .forward privilege escalation under force_command\n     - debian/patches/CVE-2026-66141.patch: stop expanding addr-\u003elocal_part in a\n       pipe transport under force_command, so a command taken from a user's\n       .forward file is only dequoted and split into argv, never evaluated with\n       the transport's privileges.\n     - CVE-2026-66141","status":"published","published":"2026-08-25T15:11:29Z","modified":"2026-10-26T09:32:03.62042259Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788259973","title":"exim: Fix of 2 CVEs","description":"- Rebuilt with rebrand to TuxCare ELS\n- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for\n  named-queues\n- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a\n  .forward file in a pipe transport under force_command","status":"published","published":"2026-09-01T10:53:04Z","modified":"2026-10-26T09:31:51.218815233Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788260209","title":"exim: Fix of 2 CVEs","description":"- Rebuilt with rebrand to TuxCare ELS\n- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for\n  named-queues\n- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a\n  .forward file in a pipe transport under force_command","status":"published","published":"2026-09-01T10:57:01Z","modified":"2026-10-26T09:31:50.327509048Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-66140","title":"CVE-2026-66140 in exim4 - Patched by Root","description":"Root has patched CVE-2026-66140 in the exim4 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-24T10:01:38Z","modified":"2026-08-24T12:30:06.062025575Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-66140","title":"CVE-2026-66140 in exim4 - Patched by Root","description":"Root has patched CVE-2026-66140 in the exim4 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-28T10:36:59Z","modified":"2026-09-28T11:15:03.365384811Z","updated_at":"2026-11-02T15:53:32.570806Z"}]}}