sagredo qmail versions prior to 2026.04.07 contain an OS command injection flaw in the notlshosts_auto function of qmail-remote.c. The vulnerable popen call is executed when processing the tls_quit command, enabling an attacker to supply arbitrary shell commands. Exploitation results in remote code execution with the privileges of the qmail process, potentially leading to full system compromise. The weakness corresponds to CWE‑78.

The affected product is sagredo qmail, any release before the 2026.04.07 update. Those running older versions should verify their installed version and apply the v2026.04.07 release, which removes the insecure popen invocation.

The CVSS score is 8.1, indicating high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog; however the exploitation path is straightforward: a remote client who can establish a TLS connection to the qmail instance can issue the tls_quit command and trigger the vulnerable popen call. The attack requires only network access to the qmail service and does not require privileged local access.