# Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and .forward Privilege Escalation (CVE-2026-66141, CVSS 7.4) Enable Local Privilege Escalation via Queue-Name Argument and force_command Abuse

> Exim 4.88-4.99.4 mishandles command-line arguments used to transfer queue-name across its internal execution chain (the -MC/-MCG re-exec options), letting a local attacker with shell access traverse outside the mail spool directory and reach arbitrary files, enabling privilege escalation (CVE-2026-66140, CVSS 8.4). A companion flaw in Exim 4.82-4.99.4 mishandles force_command expansion of a local_part in pipe transports invoked from a user's .forward file, providing a second local privilege-escalation path (CVE-2026-66141, CVSS 7.4). Both are fixed in Exim 4.99.5; no workaround exists, no public PoC or in-the-wild exploitation has been observed, and neither CVE is CISA KEV-listed.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1692
- **ID:** TL-2026-1692
- **Severity:** HIGH (CVSS 8.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-66140, CVE-2026-66141

## Description

On 2026-07-22 the Exim security team (announced by maintainer Jeremy Harris on the oss-security mailing list) published two coordinated security advisories against the Exim Internet Mailer, the open-source MTA that runs a substantial share of the world's SMTP mail infrastructure.

The first, EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1, CVE-2026-66140, CWE-24 Path Traversal), affects Exim 4.88 through 4.99.4. Exim re-executes itself internally to hand off delivery work using options that are explicitly documented as "not intended for use by external callers" -- most notably -MC (invoke another Exim instance to deliver a waiting message over an existing SMTP connection) and its companion -MCG <queue name> (signal that an alternate, named queue is in use). Because the queue-name value passed through this internal execution chain was not validated for path-traversal sequences or restricted to already-privileged users, a local attacker with command-line access could manipulate the queue-name argument to escape the configured spool directory and reach files outside it. Since Exim performs certain queue-management operations with elevated privileges, this out-of-spool file access can be leveraged for local privilege escalation, with particular risk in multi-user systems, shared/multi-tenant hosting, and containerized deployments where local shell access is more commonly available to untrusted parties.

The second, EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3, CVE-2026-66141, CWE-829 Inclusion of Functionality from Untrusted Control Sphere), affects Exim 4.82 through 4.99.4. It requires four configuration elements to be present: a redirect router granting local users .forward-file support, a reachable pipe transport, that pipe transport configured with force_command, and the pipe transport itself running as a privileged user -- a configuration pattern used to force a fixed command while still allowing limited per-user customization. Exim mishandled the expansion of the local_part inside force_command, so a local user who controls their own .forward file could inject a string-expansion that altered the command executed by the privileged pipe transport, again yielding local privilege escalation.

Both advisories credit "the unnamed and uncredited authors whose works were ingested as the training corpus" -- an unusual attribution that multiple outlets (warp2search, linuxcompatible) reported as evidence the flaws were surfaced through AI/LLM-assisted vulnerability research rather than traditional manual audit, a first for the Exim project. Exim 4.99.5, released the same day, fixes both issues: it restricts the queue-name-transferring command-line options to already-privileged users and enforces stricter character validation on queue names (CVE-2026-66140), and it removes the expansion of local_part under force_command in pipe transports (CVE-2026-66141). No interim workaround exists for either issue beyond upgrading; administrators can partially reduce CVE-2026-66141 exposure pre-patch by removing force_command from pipe transport configurations. Both vulnerabilities require pre-existing local command-line access and are not remotely exploitable; no public proof-of-concept code and no evidence of in-the-wild exploitation had been reported as of 2026-07-25, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1546 Event Triggered Execution
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1548 Abuse Elevation Control Mechanism
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1114 Email Collection

## Sources

- [EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1) official advisory](https://exim.org/static/doc/security/EXIM-Security-2026-06-22.1/EXIM-Security-2026-06-22.1.txt)
- [EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3) official advisory](https://exim.org/static/doc/security/EXIM-Security-2026-06-22.3/EXIM-Security-2026-06-22.3.txt)
- [oss-security mailing list: Exim security release announcement](https://openwall.com/lists/oss-security/2026/07/22/9)
- [Exim Vulnerability Lets Attackers Access Files Outside the Mail Spool](https://gbhackers.com/exim-vulnerability-2/)
- [Exim Directory Traversal Vulnerability Enables Privilege Escalation Attacks](https://cybersecuritynews.com/exim-directory-traversal-vulnerability/)
- [Exim Directory Traversal Vulnerability Exposes Files Outside the Mail Spool](https://cyberpress.org/exim-directory-traversal-vulnerability/)
- [Exim Directory Traversal Flaw Enables Privilege Escalation, Fixed in 4.99.5](https://securityonline.info/exim-vulnerability-directory-traversal-4-99-5/)
- [Exim Directory Traversal Vulnerability Enables Privilege Escalation Attacks](https://teamwin.in/exim-directory-traversal-vulnerability-enables-privilege-escalation-attacks/)
- [Exim 4.99.5 Drops AI-Discovered Security Patches for Mail Servers](https://www.warp2search.net/story/exim-4995-drops-aidiscovered-security-patches-for-mail-servers)
- [Exim 4.99.5 Drops AI-Discovered Security Patches for Mail Servers](https://www.linuxcompatible.org/story/exim-4995-drops-aidiscovered-security-patches-for-mail-servers)
- [Exim 4.99.5 security release (community discussion thread)](https://forum.directadmin.com/threads/exim-4-99-5-security-release.82526/)
- [CVE-2026-66141 alert entry](https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-66141)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1692