CVE-2008-2937: Postfix

Low severity, CVSS 1.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Affected products

• Postfix Postfix: version 2.5.0 only; version 2.5.1 only; version 2.5.2 only; version 2.5.3 only; version 2.6.0 only

Published 2008-08-18. Last modified 2026-06-16.