CVEvulnerability

CVE-2025-59031

4.3 MEDIUM Published 2026-03-27 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2026-03-27
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200

Description

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.

Affected configurations

• dovecot dovecot (< 2.4.3) • open-xchange dovecot (< 2.3.22.1) • open-xchange dovecot (>= 3.0.0 < 3.1.3)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References