CVE-2026-66140
Publication date 24 July 2026
Last updated 7 August 2026
Ubuntu priority
Description
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| exim4 | 26.04 LTS resolute |
Fixed 4.99.1-1ubuntu1.4
|
| 24.04 LTS noble |
Fixed 4.97-4ubuntu4.7
|
|
| 22.04 LTS jammy |
Fixed 4.95-4ubuntu2.11
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Notes
mdeslaur
Updates for this issue were released in USN-8590-1. At the time of the USN publication, there was no CVE number assigned.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.4 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H