PT-2026-33371 · Unknown · Sagredo Qmail

CVE-2026-41113 · Published 2026-04-16 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sagredo qmail versions prior to 2026.04.07

Description Remote code execution is possible due to the use of the popen() function within the notlshosts auto function in the qmail-remote.c file, which can be triggered via the 'tls quit' command.

Recommendations Update to version 2026.04.07.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-41113

Affected Products

Sagredo Qmail

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41113.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41113 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41113 · Vendor Advisory
• https://github.com/califio/publications/tree/main/MADBugs/qmail · Note
• https://github.com/sagredo-dev/qmail/pull/42 · Note
• https://github.com/sagredo-dev/qmail/commit/749f607f6885e3d01b36f2647d7a1db88f1ef741 · Note
• https://github.com/sagredo-dev/qmail/releases/tag/v2026.04.07 · Note
• https://blog.calif.io/p/we-asked-claude-to-audit-sagredos · Note
• http://openwall.com/lists/oss-security/2026/04/18/5 · Note
• https://twitter.com/oss_security/status/2045915741912727780 · Twitter Post
• https://twitter.com/CVEnew/status/2045102638706880584 · Twitter Post
• https://t.me/cveNotify/164072 · Telegram Post