CVE-2026-0394: Dovecot Path Traversal Vulnerability

CVE-2026-0394 Overview

CVE-2026-0394 is a path traversal vulnerability (CWE-22) affecting Dovecot mail server when configured to use per-domain passwd files. The vulnerability arises when these files are placed one path component above /etc, or when a slash has been added to allowed characters. In these configurations, a malicious domain component that is directory partial can trigger path traversal, allowing unauthorized access to sensitive files such as /etc/passwd.

Critical Impact

Attackers can exploit this path traversal vulnerability to read sensitive system files like /etc/passwd, potentially enabling unauthorized authentication or making system users appear as valid mail users.

Affected Products

• Dovecot mail server (configurations using per-domain passwd files)
• Dovecot installations with passwd files placed above /etc directory
• Dovecot configurations with slash added to allowed characters

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-0394 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-0394

Vulnerability Analysis

This path traversal vulnerability exists within Dovecot's authentication mechanism when processing per-domain passwd file paths. The flaw allows attackers to manipulate the domain component of authentication requests to traverse directory structures and access files outside the intended authentication directory.

When Dovecot is configured to store user credentials in per-domain passwd files (e.g., /etc/dovecot/auth/%d/passwd), the server uses the domain portion of the user's email address to construct the file path. If the passwd files are placed one directory level above /etc, or if the configuration allows slash characters in domain names, an attacker can craft a malicious domain value containing directory traversal sequences.

The vulnerability can lead to two primary security impacts: if the accessed file (such as /etc/passwd) contains password hashes, attackers may authenticate using those credentials; alternatively, if the file is used as a userdb source, system accounts could unexpectedly become valid mail users, potentially exposing internal system accounts to mail services.

Root Cause

The root cause is insufficient validation of the domain component when constructing file paths for per-domain passwd files. The application fails to properly sanitize or validate domain values before using them in file path construction, allowing directory traversal sequences to escape the intended authentication directory. This is particularly problematic when passwd files are stored in locations that make the /etc/passwd file reachable via relative path manipulation, or when the Dovecot configuration explicitly permits slash characters in domain names.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by attempting authentication with a specially crafted email address where the domain portion contains directory traversal sequences (such as ../ patterns). When Dovecot processes this authentication request, it constructs a file path using the malicious domain value, inadvertently accessing files outside the intended directory structure.

For example, if passwd files are configured at a location like /auth/%d/passwd and the attacker provides a domain value of ../etc, the resulting path could resolve to /etc/passwd instead of a legitimate domain-specific authentication file.

The vulnerability allows read access to files ending with passwd that become reachable through path traversal, enabling information disclosure of sensitive authentication data.

Detection Methods for CVE-2026-0394

Indicators of Compromise

• Authentication attempts with unusual domain patterns containing ../ or similar directory traversal sequences
• Log entries showing authentication lookups for domain values with path separator characters
• Unexpected successful authentications for system user accounts through mail services
• Authentication attempts referencing non-existent or suspicious domain values

Detection Strategies

• Monitor Dovecot authentication logs for domain values containing path traversal patterns (../, ..%2f, etc.)
• Implement log analysis rules to detect authentication attempts with abnormally long or suspicious domain components
• Review authentication success logs for accounts that match system usernames from /etc/passwd
• Enable verbose logging for authentication passdb lookups to capture path construction details

Monitoring Recommendations

• Configure SIEM rules to alert on authentication attempts with directory traversal indicators in domain fields
• Establish baseline monitoring for Dovecot authentication patterns and alert on deviations
• Implement file integrity monitoring on sensitive system files like /etc/passwd to detect unauthorized access attempts
• Review Dovecot configuration files periodically to ensure passwd file locations follow security best practices

How to Mitigate CVE-2026-0394

Immediate Actions Required

• Upgrade Dovecot to a fixed version that addresses this path traversal vulnerability
• Review current Dovecot authentication configuration for per-domain passwd file usage
• Relocate per-domain passwd files to a secure location such as /etc/dovecot/auth/%d to prevent path traversal to system files
• Audit authentication logs for any signs of exploitation attempts

Patch Information

Upgrade to a fixed version of Dovecot as recommended by the vendor. For detailed patch information and affected versions, refer to the Open-Xchange Security Advisory. No publicly available exploits are currently known for this vulnerability.

Workarounds

• Relocate per-domain passwd files to a directory structure that prevents path traversal attacks (e.g., /etc/dovecot/auth/%d)
• Switch to an alternative authentication scheme that does not rely on file paths constructed from user-controlled input
• Remove slash characters from the list of allowed characters in domain names if previously configured
• Implement input validation at the authentication layer to reject domain values containing directory traversal patterns

# Recommended configuration - move passwd files to secure location
# In dovecot.conf or auth configuration:
passdb {
  driver = passwd-file
  args = /etc/dovecot/auth/%d/passwd
}

userdb {
  driver = passwd-file
  args = /etc/dovecot/auth/%d/passwd
}