The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
DLA-4873-1 dovecot - security update
Summary
CVE-2026-42394 Pigeonhole's file storage follows any symlink encountered while resolving a script path, including symlinks in personal (user-writable) storage whose target lay outside the storage directory, thereby allowing arbitrary file disclosure via symlink traversal. Symlinks escaping personal...
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-42394 dovecot Fixed in: 1:2.3.19.1+dfsg1-2.1+deb12u7
- Ubuntu UBUNTU-CVE-2026-42394 dovecot
Original description The description as published by the source.
CVE-2026-42394 Pigeonhole's file storage follows any symlink encountered while resolving a script path, including symlinks in personal (user-writable) storage whose target lay outside the storage directory, thereby allowing arbitrary file disclosure via symlink traversal. Symlinks escaping personal storage directory are no longer followed.
(Debian LTS Security Advisories: DLA-4873-1 dovecot - security update)
Source: Debian LTS Security Advisories NVD
References
- DEBIAN-DLA DLA-4873-1 dovecot - security update