CVE-2007-2231: Dovecot

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.

Affected products

• Dovecot Dovecot: version 1.0.beta1 only; version 1.0.beta2 only; version 1.0.beta3 only; version 1.0.beta4 only; version 1.0.beta5 only; version 1.0.beta6 only; …

Published 2007-04-25. Last modified 2026-06-16.