* SECURITY UPDATE: directory traversal outside the spool area through mishandled named-queue arguments, leading to privilege escalation - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to both command-line sources of a queue name, -MCG and -q[f][f][l]G, rejecting a name that contains '/', is longer than 32 characters, or collides with one of the reserved spool subdirectories input, db, msglog and scan; mark -MC and every -MCx argument as admin-only and refuse them for a non-admin caller - CVE-2026-66140 * SECURITY UPDATE: .forward privilege escalation caused by expansion of the pipe command under force_command - debian/patches/CVE-2026-66141.patch: stop passing addr->local_part through expand_string() in the $address_pipe special case of a pipe transport that has force_command set, so command text supplied by a local user in a .forward file is only dequoted and split into arguments instead of being evaluated with the transport's privileges - CVE-2026-66141