Ox Dovecot Pro CVE-2025-59031

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates this is a remote, low-complexity attack requiring low privileges (authenticated user access) with no user interaction needed. The impact is limited to confidentiality (C:L) with no integrity or availability impact. The CVSS score of 4.3 reflects this modest impact profile. Real-world risk is constrained by three factors: (1) authentication is required-an attacker must have valid Dovecot mail access, (2) no publicly available exploit code exists, reducing immediate weaponization likelihood, and (3) the vendor recommends using alternative FTS solutions (e.g., FTS Tika) rather than patching the script itself, suggesting a design-level preference shift away from the vulnerable component. While the vulnerability allows disclosure of unindexed system files into searchable indexes, the impact is read-only and does not enable lateral movement or system compromise. SSVC analysis would classify this as low-urgency for most deployments due to authentication requirement and limited technical impact, though organizations with high-sensitivity mail content should prioritize mitigation.

An authenticated attacker with a valid mailbox account crafts a specially formatted OOXML document (e.g., a Word document or Excel file) containing embedded entries that exploit ZIP extraction logic to reference system files like /etc/passwd or other sensitive files. The attacker sends or uploads this document as an attachment into their mailbox. When Dovecot processes the attachment for full-text indexing using the vulnerable script, the malicious ZIP entries cause the extraction routine to read and index unintended system files. The attacker then uses Dovecot's full-text search functionality to query for content from those system files, gaining read access to file contents they would not normally be authorized to view. No public exploit code is available, but the attack complexity is low once an authenticated session is established.