CVE-2025-59031

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.

Affected products

Dovecot, Fts Tika, Linuxmint, Red Os, Ubuntu

Dovecot

< 2.4.3

Open-xchange Dovecot

< 2.3.22.1, 3.1.3

Fix

Available

CVSS 3.1

4.3 MEDIUM

EPSS

0.3% (20th percentile)

Weakness

CWE-200

NVD status

Analyzed

Published

2026-03-27

No exploit for CVE-2025-59031 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.