Privilege Escalation via Unsafe Request File Handling

CVE-2026-104658 is a privilege escalation vulnerability in hMailServer's live-update helper (hmailserver-update) that runs with root privileges while trusting untrusted input from an unprivileged service account. The vulnerability allows an attacker who has already achieved code execution as the hmailserver service account to escalate privileges to root by manipulating request files that specify which verification program to use and which systemd units to stop. This affects hMailServer versions 6.3.4 and 6.3.5, and is particularly dangerous because it converts a lower-privilege compromise into full system compromise. Organizations running vulnerable versions of hMailServer are exposed to complete system takeover through a two-stage attack: initial compromise of the mail service, followed by privilege escalation to root access.

While this CVE does not map to specific MITRE ATT&CK techniques in public databases, it represents exploitation of CWE-807 (Reliance on Untrusted Inputs in a Security Decision). Casky's AI-driven analysis with extended reasoning would detect attack patterns associated with Privilege Escalation (T1134) and Exploitation for Privilege Escalation (T1548), identifying suspicious systemd unit manipulation and unexpected verification binary execution originating from the hmailserver service account. Practitioners using Casky would observe findings highlighting: (1) service account processes spawning root-level operations through the hmailserver-update binary, (2) file system writes to update request directories by unprivileged accounts preceding privilege escalation, and (3) unusual verification tool invocations from non-standard paths. The platform's mapping of 754 security skills would correlate these indicators with known escalation patterns, enabling detection of the attack chain even in environments where initial mail service compromise indicators may have been missed.