EIP-2026-103098

This advisory details a misconfiguration in Exim when using Dovecot as a local delivery agent, where the 'use_shell' option in the pipe transport allows remote command execution via crafted sender addresses. The vulnerability arises from improper handling of shell metacharacters in the $sender_address variable.