{"id":169325,"date":"2026-04-19T11:11:58","date_gmt":"2026-04-19T09:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo"},"modified":"2026-04-19T11:11:58","modified_gmt":"2026-04-19T09:11:58","slug":"udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","title":{"rendered":"Remote code execution in the qmail mail server fork from the Sagredo project.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In the Sagredo project, a fork of the qmail mail server has identified a vulnerability (CVE-2026-41113) that allows remote execution of arbitrary commands on the server with qmailr user privileges. This vulnerability arises from the lack of escaping special characters in the hostname returned by the DNS server when determining the MX gateway, combined with passing the received name to the popen command without proper separation and filtering of arguments during shell invocation. The vulnerability has been fixed in the release 2026.04.07. An exploitation toolkit for this vulnerability has been published in the public domain. <\/p>\n

In October 2024, the Sagredo project added a modification to the qmail-remote utility, introducing the «notlshosts_auto» function, which remembers hosts with an incorrect implementation of the TLS protocol that cannot establish a TLS connection, to prevent looping of known failed mail delivery to such hosts. <\/p>\n

The issue is that the hostname was being saved by executing a shell command using the popen() function with the argument «\/bin\/touch %s\/control\/notlshosts\/%s'», where the MX host name returned by the DNS server was inserted. An attacker could launch their own DNS server, returning an MX record with a name like «x'`id>\/tmp\/pwned`'y.evil.com», thus achieving the execution of the injected code, creating conditions for calling the function that saves the name of the failed mail server. server<\/a>.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Sagredo \u0444\u043e\u0440\u043a\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 qmail \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-41113), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f qmailr. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432 \u0438\u043c\u0435\u043d\u0438 \u0445\u043e\u0441\u0442\u0430, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u043e\u0433\u043e DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 MX-\u0448\u043b\u044e\u0437\u0430, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u043c\u0435\u043d\u0438 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 popen \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0437\u043e\u0432\u0435 shell. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-169325","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Remote code execution in the qmail mail server fork from the Sagredo project | ProHoster","description":"In the Sagredo project, a fork of the qmail mail server has identified a vulnerability (CVE-2026-41113) that allows remote execution of arbitrary commands on the server with qmailr user privileges.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u0444\u043e\u0440\u043a\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 qmail \u043e\u0442 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Sagredo | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Sagredo \u0444\u043e\u0440\u043a\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 qmail \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-41113), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f qmailr.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-19T09:11:58+00:00","article:modified_time":"2026-04-19T09:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/169325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=169325"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/169325\/revisions"}],"predecessor-version":[{"id":170739,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/169325\/revisions\/170739"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=169325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=169325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=169325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}