CVE-2026-66140: High severity Exim Exim vulnerability
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/eximto a version that resolves this vulnerability.Fixed in 4.98.5-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66140?
The severity of CVE-2026-66140 is classified as high with a score of 8.4.
What does CVE-2026-66140 exploit in Exim?
CVE-2026-66140 exploits directory traversal vulnerabilities in Exim version prior to 4.99.5 to access files outside the spool area.
How can I fix CVE-2026-66140?
To fix CVE-2026-66140, update Exim to version 4.99.5 or higher to mitigate the vulnerability.
What are the potential impacts of CVE-2026-66140?
CVE-2026-66140 can lead to privilege escalation due to unauthorized access to sensitive files.
Which versions of Exim are affected by CVE-2026-66140?
CVE-2026-66140 affects all Exim versions prior to 4.99.5.