CVE-2026-66140: Exim Path Traversal Vulnerability

CVE-2026-66140 Overview

CVE-2026-66140 is a directory traversal vulnerability in Exim mail transfer agent versions prior to 4.99.5. The flaw stems from mishandling of arguments related to the queue-name parameter. Attackers with local access can traverse outside the spool area to access files on the host filesystem. Successful exploitation results in privilege escalation on affected systems. The vulnerability is classified under CWE-24: Path Traversal: '../filedir'.

Critical Impact
Local attackers can escape the Exim spool directory using crafted queue-name arguments to read or write arbitrary files and elevate privileges on the mail server.

Affected Products

Exim mail transfer agent versions before 4.99.5
Systems running Exim as a privileged mail service
Linux and Unix distributions bundling vulnerable Exim packages

Discovery Timeline

2026-07-24 - CVE-2026-66140 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66140

Vulnerability Analysis

Exim uses a spool directory to store queued mail messages awaiting delivery. The queue-name argument allows administrators to specify alternate named queues within the spool area. Versions before 4.99.5 fail to properly sanitize path components supplied through queue-name related arguments. The parser accepts traversal sequences such as ../ and resolves them relative to the spool directory root.

This mishandling allows a local attacker to reference paths outside the intended spool boundary. Because Exim typically runs with elevated privileges to bind to port 25 and access mail spool files owned by root or the Exim user, file operations performed under attacker-controlled paths inherit those privileges.

Root Cause

The root cause is insufficient input validation on queue-name arguments processed by Exim command-line and configuration handlers. Exim treats the queue name as a trusted path fragment and concatenates it with the spool directory prefix without canonicalizing the result or rejecting traversal metacharacters. This constitutes a classic [CWE-24] path traversal weakness.

Attack Vector

Exploitation requires local access to the host running Exim. An attacker invokes Exim binaries or triggers processing paths that accept a queue-name argument containing traversal sequences. The mail transfer agent then performs file operations against attacker-chosen destinations. Because Exim executes with setuid or elevated privileges on most deployments, arbitrary file access translates into privilege escalation to the Exim user or root. Refer to the OpenWall OSS Security advisory for technical specifics.

Detection Methods for CVE-2026-66140

Indicators of Compromise

Unexpected files created or modified outside the configured Exim spool directory such as /var/spool/exim4/
Exim process command lines containing queue-name arguments with ../ or absolute path sequences
New setuid binaries or modified system configuration files appearing after Exim invocations
Audit log entries showing Exim opening files outside its expected working directory tree

Detection Strategies

Monitor process execution telemetry for invocations of Exim binaries with suspicious -MC or queue-name arguments containing path traversal characters
Deploy filesystem integrity monitoring on directories parent to the Exim spool such as /var/spool/ and /etc/
Correlate Exim mainlog and paniclog entries with unusual queue names or file access errors

Monitoring Recommendations

Enable Linux audit rules (auditd) on the Exim binary path and spool directory to capture argument vectors and file opens
Alert on any Exim child process performing writes outside the spool area or reads of sensitive files like /etc/shadow
Review historical shell histories and cron entries for local users invoking Exim with non-standard arguments

How to Mitigate CVE-2026-66140

Immediate Actions Required

Upgrade Exim to version 4.99.5 or later on all mail servers
Restrict local shell access on hosts running Exim to trusted administrators only
Audit existing Exim spool directories and adjacent filesystem locations for unauthorized file modifications
Review Exim configuration files for exposed queue-name handling in custom routers or transports

Patch Information

Exim 4.99.5 resolves the directory traversal by validating and canonicalizing queue-name arguments before path construction. Distribution maintainers have issued updated packages tracking upstream fixes. Refer to the OpenWall OSS Security advisory for patch details and distribution-specific package versions.

Workarounds

Remove or restrict setuid privileges on the Exim binary until patching is complete, accepting reduced mail delivery functionality
Constrain Exim execution using mandatory access controls such as AppArmor or SELinux profiles that deny path traversal outside the spool directory
Disable custom queue configurations and enforce a single default queue until the update is applied

bash

# Verify installed Exim version and upgrade on Debian-based systems
dpkg -l | grep exim
sudo apt update
sudo apt install --only-upgrade exim4
exim -bV | head -n 1

# Confirm binary version meets the fixed release
# Expected output: Exim version 4.99.5 or later