CVE-2006-2414
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list...
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Record
CVE-2006-2414- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Record
CVE-2006-2414- Updated
- 2026-11-02
EUVDEUVD-2006-2415 No score
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Record
EUVD-2006-2415- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w66v-p2rf-jx67 No score
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list...
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Record
GHSA-w66v-p2rf-jx67- Updated
- 2026-11-02
OSV No score
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Record
CVE-2006-2414- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2414 No score
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Record
DEBIAN-CVE-2006-2414- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2414 is a medium vulnerability (CVSS 5.0) in Timo Sirainen Dovecot, published May 16, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in dovecot 1.0.beta8-1.
References
debian.org/security/2006/dsa-1080
dovecot.org/list/dovecot-news/2006-May/000006.html
vupen.com/english/advisories/2006/2013
secunia.com/advisories/20315
securityfocus.com/bid/17961
securityreason.com/securityalert/913
Show 7 moreShow less
dovecot.org/list/dovecot-cvs/2006-May/005563.html
exchange.xforce.ibmcloud.com/vulnerabilities/26536
nvd.nist.gov/vuln/detail/CVE-2006-2414
github.com/advisories/GHSA-w66v-p2rf-jx67
security-tracker.debian.org/tracker/CVE-2006-2414