A path traversal vulnerability in Exim allows unauthenticated attackers to compromise file integrity and confidentiality, presenting a high risk to mail server infrastructure.

This is a path traversal vulnerability (CWE-24) that occurs due to improper sanitization of file paths. The vulnerability is exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Successful exploitation of this flaw could allow an attacker to read sensitive configuration files, capture credentials, or overwrite critical system files. Given the CVSS score of 8.4, this vulnerability represents a significant risk to the availability and security of mail services, potentially leading to full system compromise or unauthorized data exfiltration.

Immediate Action: Upgrade all instances of Exim to version 4.99.5 or higher to resolve the path traversal flaw.

Proactive Monitoring: Review mail server access logs for suspicious file access requests or patterns indicating directory traversal attempts.

Compensating Controls: Implement file system permissions that restrict the service account running Exim to the minimum required directories and files.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention to prevent unauthorized access to the underlying server. Administrators must prioritize updating Exim to the latest patched version to mitigate the risk of path traversal attacks.