CVE-2026-66140: Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privilege

Description

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.

Affected Products

Vendor	Product	Versions
Exim	Exim	4.88

References

https://openwall.com/lists/oss-security/2026/07/22/9

Related News (1 articles)

Tier C

VulDB31d ago

CVE-2026-66140 | Exim up to 4.99.4 queue-name path traversal

→ No new info (linked only)

CVSS 3.18.4 HIGH

VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

4.99.5

CWECWE-24

PublishedJul 24, 2026

Last enriched31d ago

Trending Score1

Source articles1

Independent1

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

CVE-2026-66140: Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privilege

Description

Affected Products

References

Related News (1 articles)

Community Vote

Related CVEs (2)

Pin to Dashboard

Verification

Vulnerability Timeline