CVE-2025-23394
daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
- Record
CVE-2025-23394- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-61
- Updated
- 2026-11-02
EUVDEUVD-2025-27710
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
- Record
EUVD-2025-27710- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q5xr-h2vq-97x6
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows...
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
- Record
GHSA-q5xr-h2vq-97x6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-61
- Updated
- 2026-11-02
NVD
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
- Record
CVE-2025-23394- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-61
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-23394
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
- Record
UBUNTU-CVE-2025-23394- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15038-1 No score
cyradm-3.8.4-2.1 on GA media
These are all security issues fixed in the cyradm-3.8.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15038-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20962-1 No score
Security update for cyrus-imapd
This update for cyrus-imapd fixes the following issues:
Changes in cyrus-imapd:
-
cyrus-imapd don't start because of missing "Requires=var-run.mount" from systemd (bsc#1251788) Remove var-run.mount from Requires and After
-
update to version 3.8.6 (bugfix release) VUL-0: CVE-2025-49812: cyrus-imapd: Opossum Attack Application Layer Desynchronization using Opportunistic TLS (bsc#1246165) The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of implicit TLS over a dedicated port. STARTTLS is now disabled by default.
- Fixed issue #5477: master: tighten up pidfile/etc handling (bsc#1241543) VUL-0: cyrus-imapd: privilege drop happens too late, opening attack vectors from cyrus to root
- Fixed issue #5450: fix zoneinfo_db code for GCC 15 (thanks Yadd)
- Fixed issue #5309: deadlock on shutdown (thanks Mark Cammidge)
- Fixed issue #5424: recognise service-specific SASL options in
cyr_info conf-lint - Fixed issue #5420: fix double-free in http_admin (thanks Wolfgang Breyha)
- Fixed issue #5460: pop3d: add basic prometheus support (thanks Wolfgang Breyha)
- Fixed issue #5454: httpd fails to parse OpenSSL version for status string
-
update to version 3.8.5 (bugfix release)
- Fixed Issue #5029: check for unexpected extra tiny-tests directories
- Fixed Issue #5148: added --enable-release-checks configure option for use when building releases
- Fixed Issue #4489: calendar-color "changes" namespace (thanks Дилян Палаузов)
- Fixed Issue #5009: various portability warnings and nits
- Fixed Issue #5050: iTIP line endings (thanks Дилян Палаузов)
- Fixed Issue #5052: iMIP line endings (thanks Дилян Палаузов)
- Fixed Issue #5072: http_cgi use after free (thanks Дилян Палаузов)
- Fixed Issue #5094: httpd crash when PROPFIND url is /dav/calendars
- Fixed Issue #5118: broken language checks for "zr-hant" and "sr-me"
- Fixed Issue #5047: proxying UID SEARCH
-
CVE-2025-23394: cyrus-imapd: daily-backup.sh allows escalation from cyrus to root (bsc#1241536)
- Record
openSUSE-SU-2026:20962-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cyrus-imapdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.12.5.10-3ubuntu1.1+esm1 |
None known |
cyrus-imapdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.11-13.0.11-1build13.0.12-13.0.12-23.0.12-2ubuntu2 Show 7 moreShow less3.0.12-2ubuntu33.0.13-2ubuntu13.0.13-3ubuntu13.0.13-4ubuntu13.0.13-53.0.13-5ubuntu0.1~esm13.0.13-5ubuntu0.1~esm2 |
None known |
cyrus-imapdUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.2.6-2build13.4.2-23.4.2-2build13.4.3-23.4.3-3 Show 5 moreShow less3.4.3-3build23.4.3-3ubuntu0.13.4.3-3ubuntu0.1+esm13.4.3-3ubuntu0.33.4.3-3ubuntu0.3+esm1 |
None known |
cyrus-imapdUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.8.0-53.8.1-13.8.1-1build13.8.1-1build23.8.1-3 Show 5 moreShow less3.8.1-3build33.8.2-13.8.2-1ubuntu0.1~esm13.8.2-1ubuntu0.23.8.2-1ubuntu0.2+esm1 |
None known |
cyrus-imapdUbuntu:25.10 |
All versions, plus listed versions 3.10.1-23.10.1-33.10.1-3build13.10.2-1 |
None known |
cyrus-imapdUbuntu:26.10 |
All versions, plus listed versions 3.12.1-33.12.2-13.12.2-1build13.12.3-3build1 |
None known |
cyrus-imapdUbuntu:26.04:LTS |
All versions, plus listed versions 3.10.2-13.12.1-23.12.1-2build13.12.1-3 |
None known |
cyrus-imapdopenSUSE:Tumbleweed |
before 3.8.4-2.1 | 3.8.4-2.1 |
cyrus-imapdopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 3.8.6-bp160.1.1 | 3.8.6-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23394 is a critical vulnerability (CVSS 9.8) in Suse Opensuse Tumbleweed, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in cyrus-imapd 3.8.4-2.1.