CVE-2026-126612: Improper Link Resolution Before File Access ('Link Following') in hMailServer
Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hMailServerto a version that resolves this vulnerability.Fixed in 6.3.8 - Configuration
From an elevated Command Prompt, run icacls "<link>" /L /setowner *S-1-5-32-544, then icacls "<link>" /L /inheritance:r /grant:r *S-1-5-18:F *S-1-5-32-544:F *S-1-5-32-545:RX. Check the link target with dir /al, make Administrators the owner of each changeable folder above the program folder, and remove other accounts' ability to change those folders.
hMailServer program-folder path folder ownership and permissions = Owner: S-1-5-32-544; permissions: SYSTEM:F, Administrators:F, Users:RX; inheritance removed - Compensating control
Until upgrading, install hMailServer under Program Files or at a path with no link below folders that only administrators may change.
- Operational
If another account owned or could change a link or folder while hMailServer was installed there, reinstall into a new folder as described in ServiceAccount.md under "Reinstalling into a new folder".
- Operational
Restart Windows after applying the folder ownership and permission changes.