CVE-2026-0394: Path Traversal
When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0394?
The severity of CVE-2026-0394 is considered high due to the potential for unauthorized access to sensitive files.
How do I fix CVE-2026-0394?
To fix CVE-2026-0394, ensure that per-domain passwd files are not configured to be placed above the /etc directory.
What systems are affected by CVE-2026-0394?
CVE-2026-0394 affects Dovecot installations configured to use per-domain passwd files improperly.
What are the potential consequences of CVE-2026-0394?
The potential consequences of CVE-2026-0394 include the exposure of sensitive system files like /etc/passwd.
How can I prevent vulnerabilities like CVE-2026-0394 in the future?
To prevent vulnerabilities like CVE-2026-0394, always validate file paths and restrict configurations in Dovecot.