Back to Security Advisories

Security Advisory: DirectAdmin EXIM4 Configuration Injection

A configuration injection flaw in the DirectAdmin-managed Exim4 mail stack is fixed in this security release: crafted values could alter Exim's configuration with mail-server-level consequences. Update DirectAdmin and rebuild Exim through CustomBuild.

High
DirectAdmin AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9 Debian 11 Debian 12 Ubuntu 20.04 Ubuntu 22.04

Affected Versions

DirectAdmin 1.678 and earlier

Patched Version

DirectAdmin 1.679

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reload

AlmaLinux 8 / CloudLinux 8

cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reload

CentOS 7 / CloudLinux 7

cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reload

Ubuntu 22.04 / Debian 12

cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reload

Ubuntu 20.04 / Debian 11

cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reload

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

DirectAdmin manages the Exim4 mail transfer agent and its configuration on most installations. The flaw allowed configuration injection: input that reached Exim’s configuration could change how the mail server behaves — the delivery rules, the permissions, the routing. A manipulated Exim affects every mailbox and every outgoing message on the machine.

Who is affected

DirectAdmin servers running the Exim4 stack — which is essentially all of them, since Exim is the default MTA there.

How to apply the fix

  • Update DirectAdmin itself, then let CustomBuild bring packages current: cd /usr/local/directadmin/custombuild && ./build update && ./build update_versions
  • Review /etc/exim.conf modifications for unexpected additions.

For SharedLicense customers

Your DirectAdmin license is unaffected — this is panel and mail software, not licensing. Licenses keep working through the update.

Frequently Asked Questions

What does Exim configuration injection mean?
Crafted input altering the mail server configuration — routing, permissions or delivery behaviour on the whole host.
Which servers are exposed?
DirectAdmin servers running the default Exim4 mail stack.
How do I update?
Update DirectAdmin and run CustomBuild update_versions so Exim picks up the corrected configuration.

References

Security Advisories

Related Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System