Progressive Robot hMailServer: TLS configuration file path ambiguity (CVE-2026-126621)
hMailServer on Windows interprets file paths using Latin-1, while OpenSSL interprets them as UTF-8. A local attacker may exploit this path ambiguity to cause authentication bypass, unauthorized data access, or service disruption.
CVE search metadata
CVE search record: CVE-2026-126621. Severity: high. CVSS: 7.5. KEV: no. Product: hMailServer (6.0.0-B1 through 6.3.7). Brief: Progressive Robot hMailServer: TLS configuration file path ambiguity (CVE-2026-126621). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hmailserver-path-encoding-cve-2026-126621/
Triage facts
Revision 1- Applicability
- hMailServer (6.0.0-B1 through 6.3.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:04 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 on Windows pass configuration file paths to OpenSSL using Latin-1 encoding. Windows/OpenSSL behavior interprets these paths as UTF-8.
If a configured path contains non-ASCII characters, a local attacker capable of creating files or folders in accessible locations can cause the server to load malicious files instead of intended configuration files. This may lead to:
- Authentication bypass via a rogue certificate authority.
- Interception and modification of object store messages.
- Exfiltration of ACME-managed private keys.
- Denial of service by preventing TLS ports from starting.
This vulnerability is not present in default configurations, as default settings use ASCII file names and disable features like client-certificate authentication, the object store, and ACME. Linux builds are not affected.