CVE-2026-124579 | aaPanel BillionMail up to 4.9 Relay Configuration API relay.go helo_name injection

November 8, 2026 Yanac

A vulnerability was found in aaPanel BillionMail up to 4.9. It has been declared as critical. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection.

This vulnerability appears as CVE-2026-124579. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More