CVE-2026-66140

Executive Summary

CVE-2026-66140 is a directory traversal vulnerability in Exim before version 4.99.5, affecting the mail transfer agent's handling of queue-name arguments. An unauthenticated attacker with local access can exploit this flaw to read, write, or manipulate files outside the spool directory, potentially achieving arbitrary file access and privilege escalation. The vulnerability carries a CVSS score of 8.4 (High), indicating severe confidentiality, integrity, and availability impacts, though exploitation requires local access.

Technical Analysis

The flaw resides in Exim's queue management subsystem, specifically in the processing of command-line arguments passed to queue-related functions. The queue_name variable, used to identify spool subdirectories, is not properly sanitized before being used in filesystem path construction. An attacker supplying a crafted queue-name string containing path traversal sequences (e.g., ../, ..%2f) can escape the intended spool directory boundaries.

The vulnerable code path is triggered when Exim processes -q command-line options or when the queue_domains or queue_run_local options are parsed. The argument is concatenated with the spool directory path without adequate validation, allowing an attacker to redirect file operations to arbitrary locations on the filesystem. This is a classic CWE-24 (Path Traversal) vulnerability, where an application fails to neutralize special elements within a pathname.

The attack surface is primarily local, requiring the attacker to have the ability to invoke Exim binaries with crafted arguments. In typical mail server deployments, this may be achievable through restricted CGI scripts, mail aliases that invoke Exim, or other services that pass user-controlled input to Exim's queue management commands. The lack of authentication requirement (PR:N) in the CVSS vector suggests that the attack can be executed without valid credentials, though local access is still required.

The high CVSS subscores reflect the critical nature of the impact: Confidentiality (C:H) allows reading any file accessible by the Exim user, Integrity (I:H) permits overwriting arbitrary files, and Availability (A:H) enables denial-of-service by corrupting critical system files. The User Interaction (UI:N) requirement confirms that no user action is needed for exploitation.

Exploitation Scenarios

Attack Chain: Privilege Escalation via Crafted Queue-Name Argument

1. Reconnaissance and Target Identification: An attacker first identifies a target Exim server by scanning for port 25 (SMTP) responses containing Exim banner strings (e.g., 220 hostname ESMTP Exim 4.9x). The attacker then enumerates local attack vectors, such as finding a web application running as the Exim user or abusing a mail alias that executes commands.

2. Weaponization and Trigger: The attacker constructs a malicious queue-name argument designed to traverse out of the spool directory. For example:

   exim -qG../../../../tmp/malicious
   

   This argument, when processed, causes Exim to interpret the queue path as /var/spool/exim/../../../../tmp/malicious, effectively pointing to /tmp/malicious. This bypasses all directory access controls intended by the spool isolation.

3. Payload Execution: The attacker places a crafted file in the resolved directory. If the target file is a writable service configuration (e.g., /etc/ld.so.preload, /etc/cron.d/backdoor, or a Unix socket file), Exim's file operations will read or write to that location. A common technique is to write a new cron job:

   exim -qG../../../../etc/cron.d/backdoor
   

   followed by writing a malicious cron entry through Exim's error output or mail logging mechanisms.

4. Post-Exploitation Impact: Once the attacker achieves arbitrary file write, they can escalate to root by adding an entry to /etc/cron.d/ to execute a reverse shell, or by modifying /root/.bashrc to grant persistent root access. The directory traversal also enables reading sensitive files like /etc/shadow for password cracking, or /var/lib/mysql databases for data exfiltration.

Impact Assessment

The business impact of CVE-2026-66140 is substantial for any organization running Exim as their mail transfer agent. A successful exploitation results in complete compromise of the mail server host, as arbitrary file read and write capabilities typically lead to root privilege escalation. The confidentiality impact is critical, as attackers can exfiltrate sensitive email content, authentication credentials, and configuration secrets. The integrity impact allows attackers to modify system binaries, plant backdoors, or manipulate mail routing to intercept communications. Availability can be destroyed by corrupting critical system files, rendering the mail server inoperable.

The blast radius extends beyond the mail server itself: if the compromised host is part of a larger infrastructure, the attacker can pivot laterally using stolen credentials or trust relationships. In multi-tenant environments, this vulnerability could allow attackers to escape spool isolation and compromise other tenants' data.

The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) emphasizes that while the attack is local, it requires no privileges and no user interaction, making it an attractive target for privilege escalation chains. The EPSS score of 0.00272 is low, suggesting that mass exploitation is unlikely in the early period, but targeted attacks should still be considered.

Detection Guidance

Sigma Rule

title: Exim Queue-Name Directory Traversal Attempt
id: 79a4db1a-66aa-4c80-9c3f-91a0b8cd29ea
status: experimental
description: Detects Exim execution with queue-name arguments containing path traversal sequences
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/exim'
        CommandLine|contains|all:
            - '-q'
            - '..'
            - '/'
    filter:
        CommandLine|contains: '/var/spool/exim'
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate Exim queue maintenance scripts using non-standard paths
tags:
    - attack.t1190
    - cve.2026.66140

YARA Rule

rule Exim_QueueTraversal {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects Exim queue-name directory traversal exploit strings"
        cve = "CVE-2026-66140"
        date = "2026-01-01"
    strings:
        $cmd_pattern = /exim\s+-qG?[A-Za-z0-9]*\.\.\/{1,}/ ascii nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "%2e%2e%2f" ascii
        $spool_ref = "/var/spool/" ascii
    condition:
        any of ($cmd_pattern) or (2 of ($traversal*) and $spool_ref)
}

Suricata IDS Rule

alert shellcode any any -> any any (
    msg:"CVE-2026-66140 Exim queue-name directory traversal attempt";
    content:"/exim";
    content:"-qG";
    content:"../";
    distance:0;
    pcre:"/exim\s+-qG[A-Za-z0-9]*\.\.\//i";
    sid:2026066140;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
    reference:cve,2026-66140;
)

Elastic Detection

process where event.action == "exec" and 
    process.name == "exim" and 
    process.args contains "-q" and 
    process.args contains ".." and 
    not process.args Contains "/var/spool/"

Splunk SPL Query

index=main sourcetype=linux_secure OR sourcetype=linux_sysmon
| where process_name="exim" AND CommandLine LIKE "%-q%" AND CommandLine LIKE "%../%"
| rename CommandLine as full_command
| eval is_legit=if(match(full_command, "^/var/spool/exim"), "true", "false")
| where is_legit=="false"
| table _time, host, user, process_name, full_command
| stats count by host, user

Wazuh OSSEC Rule

<group name="exim,malware,">
  <rule id="100491" level="12">
    <decoded>command_line</decoded>
    <field name="command_line">\.exim\s+-q.*\.\.\/</field>
    <description>Exim process executed with directory traversal queue-name - potential CVE-2026-66140 exploitation</description>
    <group>exim,vulnerability,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source (Debian) claims patch, not independently confirmed).

1. Immediate Mitigations:

   • Restrict local execution of Exim binaries to trusted administrators via filesystem permissions (e.g., chmod 750 /usr/sbin/exim).
   • Monitor process execution logs for anomalous Exim invocations containing -qG flags with path traversal patterns.
   • Implement auditing on the spool directory to detect out-of-bounds file access attempts.
   • Disable queue-run functionality in restricted contexts if not critical to operations.

2. Patch/Upgrade Steps:

   • Upgrade to Exim 4.99.5 or later, which contains the fix for the queue-name argument mishandling. This version is available via Debian security repositories and upstream Exim distribution channels.
   • Apply the patch from Debian's security tracker (DSA-XXXX) for systems that cannot upgrade immediately. Verify patch integrity via official Debian mirrors.
   • For custom builds, obtain the fix from the official Exim Git repository and rebuild with proper signing verification.
   • Subscribe to the Exim announcements mailing list to receive updates when the fix is independently confirmed.

3. Long-Term Hardening:

   • Run Exim under a dedicated low-privilege user account with chroot jail if feasible.
   • Implement egress filtering on mail servers to prevent outbound connections from compromised hosts.
   • Deploy file integrity monitoring (e.g., Tripwire, AIDE) on critical system files that could be targets of traversal attacks.
   • Establish a patch management process that prioritizes mail server updates within 7 days of release.
   • Conduct periodic security reviews of Exim configuration and queue management scripts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66140
2. Exim Official Website/Announcements: https://www.exim.org/
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-66140
4. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66140
5. Exim Git Repository (Patch Source): https://git.exim.org/

Threat Actor Campaigns & Exploit-in-the-Wild Evidence:

• As of the report date, there are no confirmed reports of active exploitation in the wild. The CISA KEV catalog has not listed this CVE, and no threat actor campaigns have been publicly attributed to this vulnerability. However, the high CVSS score and the prevalence of Exim in mail server infrastructure make it a prime candidate for inclusion in exploit kits targeting server-side software. Organizations should monitor their local Exim logs for any signs of the attack patterns described in this report.