The vulnerability arises from improper limitation of pathname traversal in OX Dovecot Pro when per-domain passwd files are configured in a way that allows directory traversal above /etc or inclusion of slashes in allowed characters. This can cause the system to read sensitive files like /etc/passwd inadvertently. If these files contain passwords or user database information, it may lead to incorrect authentication or validation of system users. The CVSS 3.1 base score is 5.3, indicating medium severity. No known public exploits exist. Recommended mitigations include upgrading to a fixed version, changing the authentication scheme, or relocating passwd files to a secure directory.

An attacker can exploit this vulnerability to read sensitive files such as /etc/passwd if dovecot is misconfigured with per-domain passwd files placed improperly or allowing slashes in domain components. This may result in incorrect authentication or unauthorized validation of system users. There is no indication of impact on integrity or availability. No public exploits are known at this time.

Upgrade to a fixed version of OX Dovecot Pro when available. Alternatively, use an authentication scheme that does not rely on path-based per-domain passwd files. Another mitigation is to ensure per-domain passwd files are stored in a secure directory such as /etc/dovecot/auth/%d, avoiding placement one directory above /etc or allowing slashes in domain components. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.