CVE-2026-66140

HighCVSS 7.8/10Last modified Aug 17, 2026

Description

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-24

Affected software

Vendor	Product	Versions
Exim	Exim	>= 4.88, < 4.99.5

References

https://openwall.com/lists/oss-security/2026/07/22/9Mailing List, Third Party Advisory

Timeline

Published: Jul 24, 2026
Last modified: Aug 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-661417.8Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.CVE-2026-661427.5Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may CVE-2026-661437.5It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted CVE-2026-661447.5Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a d CVE-2026-661459.1An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remot CVE-2026-661466.1Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote CVE-2026-661479.4An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allo CVE-2026-661486.3An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier vers CVE-2026-661497.8Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated at CVE-2026-66157.3A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file supera CVE-2026-661507.8Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated at CVE-2026-661515.5SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver,