# CVE-2026-66140: Exim directory traversal in queue-name arguments

Source: https://junglewise.ai/threats/cve-2026-66140-exim-directory-traversal-in-queue-name-arguments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66140 · Severity: high · CVSS 8.4 · Published 2026-07-24

Exim, a widely used mail transfer agent responsible for delivering email on Unix-like systems, contains a security flaw that allows local users to access restricted files. By providing specially crafted command-line arguments, an attacker can bypass security boundaries to read or modify sensitive data outside of the normal mail queue area. This can lead to a full takeover of the mail server or elevated system privileges, potentially compromising the confidentiality and integrity of all communications handled by the server.

Technologies: [Exim](https://junglewise.ai/threats/technologies/exim). Vendors: [Exim](https://junglewise.ai/threats/vendors/exim).

## Quick answers

**Is CVE-2026-66140 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66140 being exploited in the wild.

**How severe is CVE-2026-66140?** High severity, with a CVSS score of 8.4, published 24 July 2026.

**Which products and versions are affected?** Exim 4.88 through 4.99.4.

**Is there a fix for CVE-2026-66140?** A patch was published on 2026-07-22: Public release of version 4.99.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66140 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-66140?** Check whether you run Exim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability (CWE-24) exists in Exim versions 4.88 through 4.99.4. The flaw is rooted in the mishandling of command-line arguments used to pass queue names through an Exim execution chain. A local attacker with command-line access can exploit this by supplying path traversal sequences (e.g., ../) to access files outside of the designated spool directory. Because Exim often operates with elevated privileges to manage mail delivery, this unauthorized file access can be leveraged to achieve full privilege escalation on the host system. The issue is resolved in version 4.99.5.

## Affected products

- Exim Exim 4.88 through 4.99.4

## Timeline

- 2026-06-22: other: Report received by maintainers
- 2026-06-23: other: Fix drafted
- 2026-07-13: other: Advance notice sent to distributions
- 2026-07-22: patched: Public release of version 4.99.5
- 2026-07-24: advisory: NVD publication date

## References

- [https://openwall.com/lists/oss-security/2026/07/22/9](https://openwall.com/lists/oss-security/2026/07/22/9)

## Related threats

- [Exim SMTP smuggling in DATA phase rejection handling](https://junglewise.ai/threats/cve-2026-94057-exim-before-4-100-1-allows-smtp-smuggling-in-which-the-received)
- [Exim Proxy Protocol stack memory disclosure](https://junglewise.ai/threats/cve-2026-94056-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.](https://junglewise.ai/threats/cve-2026-94055-exim-before-4-100-1-when-certain-non-default-tls-settings-are)
- [Exim out-of-bounds write in Proxy Protocol v1](https://junglewise.ai/threats/cve-2026-94054-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim privilege escalation in .forward pipe transport force_command](https://junglewise.ai/threats/cve-2026-66141-exim-privilege-escalation-in-forward-pipe-transport-force-command)