Sieve CVE-2026-42394

Requires the attacker to control a symlink in a filesystem location processed by the Sieve service (typically the per-user Sieve script store or mail spool), which in turn requires either local filesystem access or an authenticated mail account able to upload/manage Sieve scripts (e.g., via ManageSieve). Exploitation is limited to reading files accessible to the Sieve/mail service account and yields disclosure only - no code execution, modification, or denial of service. It is NOT remote-unauthenticated against a default configuration: an attacker with no account and no local access cannot plant the required symlink. Precise triggering conditions (which files the service opens by path, and whether symlink-safe open flags were used) are not specified in the available data and should be confirmed against the upstream advisory.

Risk signals are almost entirely absent from the input: no CVSS score/vector, no CWE, no EPSS probability, no KEV listing, no POC reference, and no SSVC data - the only source is an Ubuntu security-tracker-style one-line summary. Based on the description alone ('sieve: symlink traversal flaw could result in arbitrary file disclosure'), this is a confidentiality-only file-disclosure bug in a Sieve email-filtering implementation (most plausibly Dovecot Pigeonhole Sieve or a similar mail-filter component packaged by Ubuntu), classifiable as CWE-59 (link following) leading to CWE-200-style disclosure. Symlink-traversal disclosure bugs are typically LOCAL and require the ability to place or control a symlink in a directory the vulnerable process reads (e.g., a user's mail/Sieve script storage), so despite 'arbitrary file disclosure' sounding severe, real-world risk is bounded by needing an authenticated/local foothold and yields no integrity or availability impact. With no EPSS, no KEV, and no POC in the data, treat this as a moderate, patch-in-normal-cycle issue rather than an emergency. CRITICAL GAPS: CVSS vector is missing so attack vector and privilege level cannot be confirmed from data; the exact affected product and version range are not stated - verify against the Ubuntu CVE tracker and upstream (Dovecot/Pigeonhole) advisory before final prioritization.

An authenticated mail user (or a local user able to write into a Sieve/mail spool directory) plants a symlink whose name matches a file the Sieve service opens and points it at a sensitive file outside their authorization (e.g., another user's mail, a Sieve script, or a system file readable by the mail process). When the service follows the link during script processing or storage, the target file's contents are disclosed back to the attacker. No public exploit is identified in the provided data, and successful exploitation depends on local/authenticated placement of the symlink rather than remote unauthenticated access.