aaPanel BillionMail, versions up to 4.9, contains an injection flaw in the core/api/relay/v1/relay.go component. An attacker can manipulate the helo_name argument to inject arbitrary data, which may lead to injection attacks against the mail server. The vulnerability is remote by nature and has been publicly disclosed, meaning that the exploit code is accessible to attackers.

The affected product is aaPanel BillionMail up to version 4.9. The flaw resides in the Relay Configuration API and affects any instance that exposes this API without proper input validation. If an operator configures the API with default or public network access, the risk is increased.

The CVSS score of 5.3 indicates a medium severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. However, the flaw can be exploited remotely, the exploit has been disclosed publicly, and it may be used in targeted attacks. Consequently, the overall risk is moderate, with the potential to compromise the integrity or availability of the mail relay service.