CVE-2025-59031

NameCVE-2025-59031
DescriptionDovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6197-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dovecot (PTS)bullseye1:2.3.13+dfsg1-2+deb11u1vulnerable
bullseye (security)1:2.3.13+dfsg1-2+deb11u2vulnerable
bookworm1:2.3.19.1+dfsg1-2.1+deb12u1vulnerable
bookworm (security)1:2.3.19.1+dfsg1-2.1+deb12u3fixed
trixie1:2.4.1+dfsg1-6+deb13u3vulnerable
trixie (security)1:2.4.1+dfsg1-6+deb13u4fixed
forky1:2.4.2+dfsg1-4vulnerable
sid1:2.4.3+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dovecotsourcebookworm1:2.3.19.1+dfsg1-2.1+deb12u2DSA-6197-1
dovecotsourcetrixie1:2.4.1+dfsg1-6+deb13u4DSA-6197-1
dovecotsource(unstable)1:2.4.3+dfsg1-1unimportant

Notes

https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/IKIHZX77IPTGSP5WBIPJUOFBUQFKVPE7/
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html#cve-2025-59031-decode2text-sh-ooxml-extraction-may-follow-symlinks-and-read-unintended-files-during-indexing
decode2text.sh only installed in dovecot-core/examples
https://github.com/dovecot/core/commit/36a95e7fa6b913db6c03a15862628b06be66eb3e (2.4.3)

Search for package or bug name: Reporting problems