high
advisory
aaPanel BillionMail: Injection vulnerability in Relay Configuration API (CVE-2026-124579)
An injection vulnerability exists in the Relay Configuration API of aaPanel BillionMail up to version 4.9.
CVE search metadata
CVE search record: CVE-2026-124579. Severity: high. CVSS: 7.4. KEV: no. Product: BillionMail (up to 4.9). Brief: aaPanel BillionMail: Injection vulnerability in Relay Configuration API (CVE-2026-124579). Brief link: https://feed.craftedsignal.io/briefs/2026-11-aapanel-billionmail-injection/
Triage facts
Revision 1- Applicability
- BillionMail (up to 4.9)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 09:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in aaPanel BillionMail up to 4.9 within the 'core/api/relay/v1/relay.go' file of the Relay Configuration API. Manipulating the 'helo_name' argument can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed. The vendor did not respond to disclosure attempts.