Read the docs
TI-2024-23253 Aliases CVE-2024-35179

Unprivileged Stalwart Mail Server user can read files as root

Priority MEDIUM 63CWE-271Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins) can read arbitrary files as root. This issue affects admins who have set up to run stalwart with `RUN_AS_USER` who handed out admin credentials to the mail server but expect these to only grant access according to the `RUN_AS_USER` and are attacked where the attackers managed to achieve Arbitrary Code Execution using another vulnerability. Version 0.8.0 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00621 50th percentileScored 2026-11-07
Fix Fixed mail-server (stalwartlabs): 0.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stalwartlabsmail-serverbefore 0.8.00.8.0Patch availableCNA
  • mail-server Vendorstalwartlabs Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:stalwartlabs:mail-server:*:*:*:*:*:*:*:*——stalwartlabs
  • cpe:2.3:a:stalwartlabs:mail-server:*:*:*:*:*:*:*:* Versions — — ·stalwartlabs

Remediation

  • Fix · CNA mail-server (stalwartlabs) Fixed in 0.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35179
  2. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2024-23261 Stalwart Mail Server has privilege escalation by design CVSS 3.1CRITICAL 9.1
  • TI-2026-56046 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri CVSS 4.0HIGH 8.5
  • TI-2025-38045 Unbounded Memory Allocation in Stalwart IMAP parser CVSS 3.1HIGH 7.5
  • TI-2025-36687 Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences