This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-66140 →

DEBIAN-CVE-2026-66140

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related t...

Original description

The description as published by the source.

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 exim4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 exim4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u4"}]}]

Debian:14 exim4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.4-2"}]}]

References

advisory security-tracker.debian.org