CVE-2025-59031

Katalog CVE

CVSS 4.3 · Medium EPSS 0,28%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada dovecot, open-xchange dovecot. Skor CVSS 3.1 4.3 (Medium) menurut open-xchange.com.

Deskripsi (NVD)

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber open-xchange.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json advisory vendor