by Kastro CVE-2026-27851
Open-Xchange GmbH OX Dovecot Pro — When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, ena…
Description · from the CVE record
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
Affected
ProductAffectedFixed inSource
OX Dovecot Pro≤ 3.1.4–CNA
OX Dovecot Pro≤ 2.4.3–CNA
Red Hat Enterprise Linux 10see advisory–redhat-SADP
Red Hat Enterprise Linux 6see advisory–redhat-SADP
Red Hat Enterprise Linux 8see advisory–redhat-SADP
Red Hat Enterprise Linux 9see advisory–redhat-SADP
Scores by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
OX (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
redhat-SADP (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total