CVE-2026-124579: aaPanel BillionMail Relay Configuration API relay.go injection
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument heloname can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must have low-level privileges and be able to reach the Relay Configuration API remotely. No user interaction is required.
Which deployments should be treated as potentially affected?
aaPanel BillionMail versions up to 4.9 are identified as affected. The issue involves the Relay Configuration API handling of the helo_name argument in core/api/relay/v1/relay.go.
How urgent is remediation?
Prioritize remediation because a public exploit has been disclosed and the attack is rated high severity. The reported impact includes limited confidentiality, integrity, and availability effects, with scope changed.