CLSA-2026-1787328725
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787328725
- Upstream
CVE (2)
- CVE-2026-66140
- CVE-2026-66141
- Published
- 2026-08-21T16:12:18Z
- Modified
- 2026-10-26T09:31:40Z
- Summary
- Fix CVE(s): CVE-2026-66140, CVE-2026-66141
- Details
-
- SECURITY UPDATE: directory traversal outside the spool area through
mishandled named-queue arguments, leading to privilege escalation
- debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to both command-line sources of a queue name, -MCG and -q[f][f][l]G, rejecting a name that contains '/', is longer than 32 characters, or collides with one of the reserved spool subdirectories input, db, msglog and scan; mark -MC and every -MCx argument as admin-only and refuse them for a non-admin caller
- CVE-2026-66140
- SECURITY UPDATE: .forward privilege escalation caused by expansion of
the pipe command under force_command
- debian/patches/CVE-2026-66141.patch: stop passing addr->local_part through expand_string() in the $address_pipe special case of a pipe transport that has force_command set, so command text supplied by a local user in a .forward file is only dequoted and split into arguments instead of being evaluated with the transport's privileges
- CVE-2026-66141
- SECURITY UPDATE: directory traversal outside the spool area through
mishandled named-queue arguments, leading to privilege escalation
- References