Exim Vulnerability Lets Attackers Access Files Outside the Mail Spool

A high-severity directory traversal vulnerability has been discovered in the Exim mail transfer agent. This flaw allows local attackers to access files outside the intended mail spool directory and potentially escalate their privileges.

It is tracked as EXIM-Security-2026-06-22.1 and assigned GCVE-25-2026-07-45-1. The vulnerability affects Exim versions 4.88 through 4.99.4 and was announced on July 22, 2026.

Exim Vulnerability

The issue arises from improper handling of command-line arguments used to pass queue names across Exim execution chains.

By manipulating these arguments, an attacker with local access to the system can traverse directories beyond the restricted spool path, enabling unauthorized file access.

In certain scenarios, this could lead to privilege escalation, making the vulnerability particularly dangerous in shared or multi-user environments where Exim is deployed.

According to the advisory, exploitation requires command-line access to the host system, which limits remote attack vectors. However, it still poses a significant risk in environments with multiple users, containerized workloads, or misconfigured permissions.

The flaw affects both stable and development branches of Exim, indicating a longstanding issue in its argument parsing logic dating back to version 4.88, initially released in 2017.

The vulnerability was reported on June 22, 2026, with a fix drafted the following day. After coordinated disclosure with downstream distributors via the Openwall distros mailing list, a patched version, Exim 4.99.5, was released.

This update introduces stricter validation of command-line inputs, limiting the use of queue-related options to already privileged users and enforcing tighter character restrictions on queue names to prevent traversal sequences.

No official mitigation or workaround has been provided; therefore, immediate patching is the only effective remediation strategy. Security teams are strongly advised to upgrade to Exim 4.99.5 or later without delay.

Systems running older versions should be considered at risk, especially if local shell access is granted to untrusted users or if automated processes invoke Exim with user-controlled parameters.

The updated release is available through Exim’s official distribution channels, including its FTP repository and Git source. The release tag “exim-4.99.5” has been cryptographically signed, ensuring integrity and authenticity for administrators deploying the update in production environments.

From a defensive perspective, organizations should audit their systems for unusual file access patterns related to Exim processes and review user permissions that may allow command-line interaction with the mail transfer agent.

Monitoring for abnormal invocation of Exim binaries and restricting unnecessary local access can further reduce the risk of exploitation.

This disclosure highlights the ongoing importance of secure input validation in system-level utilities. It emphasizes the need for timely patch management, particularly for widely used infrastructure components like mail servers.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.