UnratedFix available
dovecot — security advisory
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Products
- dovecot
- Affected versions
- Not specified
- Fixed versions
- 1.0.beta8-1
- CVEs
- CVE-2006-2414
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:08 UTC · Revision 1
Source evidence
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
osv:DEBIAN-CVE-2006-2414
dovecot
Fixed versions: 1.0.beta8-1
dovecot
Fixed versions: 1.0.beta8-1
dovecot
Fixed versions: 1.0.beta8-1
Complete source record
{
"id": "e7358ace418301aa57620b277a1de6ea539d7354dab1681096dc226a72c7b90f",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-2414",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-2414",
"summary": "Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via \"..\" sequences in the (1) LIST or (2) DELETE IMAP command.",
"evidence": "osv:DEBIAN-CVE-2006-2414",
"products": [
{
"name": {
"value": "dovecot",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.0.beta8-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "dovecot",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.0.beta8-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "dovecot",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.0.beta8-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-2414",
"aliases": [
"DEBIAN-CVE-2006-2414"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.beta8-1"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:deb/debian/dovecot?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2414.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.beta8-1"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:deb/debian/dovecot?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2414.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.beta8-1"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:deb/debian/dovecot?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2414.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-22T23:47:18.879281825Z",
"provider": "osv",
"upstream": [
"CVE-2006-2414"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-2414"
]
},
"related_cves": [
{
"value": "CVE-2006-2414",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410178,
"published_at": "2006-05-16T10:02:00+00:00"
}