Exim fixes two local privilege-escalation flaws in version 4.99.5

Exim maintainers released Exim 4.99.5 to fix two local privilege-escalation vulnerabilities affecting multiple prior versions of the mail transfer agent. According to the security advisory, EXIM-Security-2026-06-22.1 is a local directory traversal issue affecting Exim 4.88 through 4.99.4 that can let a local user access files outside the spool directory through queue-name transfer command-line arguments, while EXIM-Security-2026-06-22.3 is a command-execution flaw affecting 4.82 through 4.99.4 in certain .forward and pipe transport configurations.

The project said there is no mitigation for the directory traversal bug short of upgrading, and that the command-execution issue can be reduced by avoiding force_command on pipe transports. Release listings and distribution archives show the patched version has been published through Exim's official release channels, and administrators are being urged to update to 4.99.5 to prevent local file access and privilege-escalation risks on affected systems.