The vulnerability occurs during the initial setup of LinkAce instances that have not yet been configured. The setup flow writes attacker‑controlled database credentials directly into the .env file without proper escaping, allowing a newline injection that can add arbitrary mail‑configuration variables. When the application later performs a mail operation, the injected variables can be used to execute commands through the mail system, giving the attacker remote code execution on the server.

This flaw affects installations of Kovah LinkAce versions earlier than 2.5.6 that have not completed the initial configuration. Any uninitialized instance that exposes the setup endpoints to the internet or to an attacker‑controlled network segment is vulnerable.

The CVSS score of 8.1 indicates high severity, and the EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalogue, but the ability to execute code remotely via a publicly reachable initial setup process makes it feasible for attackers. A typical attack would involve sending a crafted set of database credentials to the /setup endpoint, injecting newline characters to add mail variables, and then the application sending an email that contains the injected command, leading to arbitrary code execution.