PT-2026-28308 · Dovecot+2 · Dovecot+2

Strokep · Published 2026-01-01 · Updated 2026-04-28 · CVE-2026-0394

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dovecot (affected versions not specified)

Description Dovecot is susceptible to a path traversal issue when configured to use per-domain passwd files. If these files are located one path component above /etc, or if a slash character is included in the allowed characters, an attacker could potentially read sensitive files like /etc/passwd. Accessing this file could lead to incorrect authentication or the appearance of system users as valid users when using a user database. No publicly available exploits are known.

Recommendations Upgrade to a fixed version. Alternatively, use a different authentication scheme that does not rely on paths. Ensure that the per-domain passwd files are located in a different directory, such as /etc/dovecot/auth/%d.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-0394

OESA-2026-1849

USN-8136-1

USN-8136-2

Affected Products

Dovecot

Linuxmint

Ubuntu

References · 32

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27859 · Security Note
• https://ubuntu.com/security/notices/USN-8136-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59028 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0394 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27857 · Security Note
• https://ubuntu.com/security/CVE-2026-27857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0394 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27855 · Security Note
• https://ubuntu.com/security/CVE-2026-27859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27856 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8136-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-0394 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27858 · Security Note