CVE-2010-1132: The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand...

Security readout for executives and security teams

CVE-2010-1132 lets a remote sender run system commands through a crafted email recipient field when SpamAssassin Milter Plugin 0.3.1 uses the expand option. For an exposed mail gateway, this can turn normal email delivery traffic into server compromise. Active exploitation is not confirmed by KEV or the supplied sources. Organizations are most exposed if they run spamass-milter 0.3.1 on internet-facing mail infrastructure and have the expand option enabled. Exposure is lower if the plugin is absent, updated through vendor packages, or expand is disabled. Prioritize mail gateways first. This is a remote command execution issue on a perimeter service, with public exploit information. Treat as urgent if spamass-milter 0.3.1 with expand is present. Mitigation focus: Identify all systems running SpamAssassin Milter Plugin or spamass-milter packages.; Apply relevant vendor updates from Debian, Fedora, Red Hat, or your distribution.; Disable the expand option where operationally possible..

Prepared

Jun 28, 2026, 08:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.