CVE-2006-2414: Timo Sirainen Dovecot

Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.

Affected products

• Timo Sirainen Dovecot: version 1.0 only; version 1.0_beta2 only; version 1.0_beta3 only; version 1.0_beta7 only

Published 2006-05-16. Last modified 2026-06-16.