Vulnerability · Published Mar 27, 2026 · Assigned by OX
CVE-2025-59031
Medium 4.3
In plain English
A medium-severity information exposure in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | dovecot | 2.4.3-r0 | ALPINE-CVE-2025-59031 |
| Alpine:v3.24 | dovecot | 2.4.3-r0 | ALPINE-CVE-2025-59031 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u2 | DEBIAN-CVE-2025-59031 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u4 | DEBIAN-CVE-2025-59031 |
| Debian:14 | dovecot | 1:2.4.3+dfsg1-1 | DEBIAN-CVE-2025-59031 |
| Ubuntu:22.04:LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.7 | UBUNTU-CVE-2025-59031 |
| Ubuntu:24.04:LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.3 | UBUNTU-CVE-2025-59031 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.1 | UBUNTU-CVE-2025-59031 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 2.3.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N