Path traversal in Dovecot and OX Dovecot Pro - CVE-2026-0394

Vulnerability identifier: #VU124724

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-0394

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper limitation of a pathname to a restricted directory ('Path Traversal') in passwd-file passdb when processing domain-based authentication requests. A remote attacker can send a specially crafted request with malicious domain parameter to disclose sensitive information.

The server must be configured to use per-domain passwd files placed one path component above /etc or with slash in allowed characters.

Dovecot
OX Dovecot Pro
openEuler
Ubuntu
dovecot
dovecot-debuginfo
dovecot-debugsource
dovecot-devel
dovecot-help
dovecot (Ubuntu package)

Install security update from vendor's website.

Dovecot - update to 2.4.0
OX Dovecot Pro - update to 3.1.0
dovecot - update to 2.3.15-7
dovecot-debuginfo - update to 2.3.15-7
dovecot-debugsource - update to 2.3.15-7
dovecot-devel - update to 2.3.15-7
dovecot-help - update to 2.3.15-7
dovecot (Ubuntu package) - addressed in versions 1:2.3.16+dfsg1-3ubuntu2.7, 1:2.3.16+dfsg1-3ubuntu2.8, 1:2.3.21+dfsg1-2ubuntu6.3, 1:2.3.21+dfsg1-2ubuntu6.4, 1:2.4.1+dfsg1-5ubuntu4.1

• https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html

• Path traversal in Dovecot
• Ubuntu update for dovecot
• openEuler update for dovecot
• Ubuntu update for dovecot