Back Linuxsecurity Debian Dovecot DLA-4556-1 CVE-2025
CVE-2025-59031 The decode2text.sh example script, which was installed into dovecot-core/examples, was found handle zip-style attachment in an unsafe manner. In particular, OOXML extraction may follow symlinks and read unintended files during indexing. The script is no longer installed. CVE-2025-59032 It was found that the ManageSieve AUTHENTICATE command crashes the ManageSieve service when using literal as SASL initial response, leading to Denial of Service. CVE-2026-0394 A pass traversal vulnerability was discovered in the passwd-file passdb/userdb when dovecot has been configured to use per-domain passwd files, allowing inadvertently reading /etc/passwd in some situations. If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can incorrectly make system users appear valid users. CVE-2026-27855 The OTP authentication driver was found to be vulnerable to replay
CVE-2025-59031 The decode2text.sh example script, which was installed into dovecot-core/examples, was found handle zip-style attachment in an unsafe manner. In particular, OOXML extraction may follow symlinks and read unintended files during indexing. The script is no longer installed. CVE-2025-59032 It was found that the ManageSieve AUTHENTICATE command crashes the ManageSieve service when using literal as SASL initial response, leading to Denial of Service. CVE-2026-0394 A pass traversal vulnerability was discovered in the passwd-file passdb/userdb when dovecot has been configured to use per-domain passwd files, allowing inadvertently reading /etc/passwd in some situations. If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can incorrectly make system users appear valid users. CVE-2026-27855 The OTP authentication driver was found to be vulnerable to replay
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
