CVE-2007-2231

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when...

4.3 MediumFix available

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.

Exploit likelihood

2.12%Down 1.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2007-2231
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-2231
Updated: 2026-11-02

EUVDEUVD-2007-2226 No score

Record: EUVD-2007-2226
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8qfr-2vxg-8g3g No score

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when...

Record: GHSA-8qfr-2vxg-8g3g
Updated: 2026-11-02

OSV No score

Record: CVE-2007-2231
Updated: 2026-11-02

OSVDEBIAN-CVE-2007-2231 No score

Record: DEBIAN-CVE-2007-2231
Updated: 2026-11-02

Affected products

dovecot

Affected packages

Affected packages
Package	Affected	Fixed
`dovecot` Debian:12	before 1.0.rc29-1	1.0.rc29-1
`dovecot` Debian:13	before 1.0.rc29-1	1.0.rc29-1
`dovecot` Debian:14	before 1.0.rc29-1	1.0.rc29-1
`dovecot` Debian:4.0	before 1.0.rc15-2etch1, plus listed versions 1.0.rc15-2	1.0.rc15-2etch1
`dovecot` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs	before 0:1.0.7-2.el5	0:1.0.7-2.el5
`dovecot-debuginfo` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs	before 0:1.0.7-2.el5	0:1.0.7-2.el5
`dovecot` Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs	before 0:1.0.7-2.el5	0:1.0.7-2.el5
`dovecot-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs	before 0:1.0.7-2.el5	0:1.0.7-2.el5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, facts, references, title	GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-2231 is a medium vulnerability (CVSS 4.3) in Dovecot, published April 25, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 82nd percentile. Fixed in dovecot 1.0.rc29-1.

References

Show 33 moreShow less