{"id":"CVE-2025-23394","aliases":["EUVD-2025-27710","GHSA-q5xr-h2vq-97x6","UBUNTU-CVE-2025-23394","openSUSE-SU-2025:15038-1","openSUSE-SU-2026:20962-1"],"status":"published","title":"daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed  cyrus-imapd before 3.8.4-2.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00599,"percentile":0.49111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2025-04-29T00:00:00Z","modified":"2026-10-17T12:56:48Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"cyrus-imapd","fixed_in":["3.8.4-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1","2.5.10-3ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5","3.0.13-5ubuntu0.1~esm1","3.0.13-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.6-2build1","3.4.2-2","3.4.2-2build1","3.4.3-2","3.4.3-3","3.4.3-3build2","3.4.3-3ubuntu0.1","3.4.3-3ubuntu0.1+esm1","3.4.3-3ubuntu0.3","3.4.3-3ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-5","3.8.1-1","3.8.1-1build1","3.8.1-1build2","3.8.1-3","3.8.1-3build3","3.8.2-1","3.8.2-1ubuntu0.1~esm1","3.8.2-1ubuntu0.2","3.8.2-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.1-2","3.10.1-3","3.10.1-3build1","3.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-3","3.12.2-1","3.12.2-1build1","3.12.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1","3.12.1-2","3.12.1-2build1","3.12.1-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"suse","product":"opensuse tumbleweed"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23394","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23394"},{"url":"https://github.com/advisories/GHSA-q5xr-h2vq-97x6"},{"url":"https://ubuntu.com/security/CVE-2025-23394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23394","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23394","tags":["web"]},{"url":"https://bugzilla.suse.com/1241536","tags":["report"]},{"url":"https://bugzilla.suse.com/1241543","tags":["report"]},{"url":"https://bugzilla.suse.com/1246165","tags":["report"]},{"url":"https://bugzilla.suse.com/1251788","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49812","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-23394","title":"daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed  cyrus-imapd before 3.8.4-2.1.","status":"published","published":"2025-05-26T15:34:32.562Z","modified":"2025-05-27T14:05:20.489Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:32:33.082076Z"}],"euvd":[{"id":"EUVD-2025-27710","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed  cyrus-imapd before 3.8.4-2.1.","status":"published","published":"2025-05-26T15:34:32Z","modified":"2025-05-27T14:05:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:38.869898Z"}],"ghsa":[{"id":"GHSA-q5xr-h2vq-97x6","title":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows...","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed  cyrus-imapd before 3.8.4-2.1.","status":"published","published":"2025-05-26T18:30:25Z","modified":"2025-05-27T15:32:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:02:26.855176Z"}],"nvd":[{"id":"CVE-2025-23394","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed  cyrus-imapd before 3.8.4-2.1.","status":"published","published":"2025-05-26T16:15:20.24Z","modified":"2026-06-17T08:54:00.967Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:11:09.562272Z"}],"osv":[{"id":"UBUNTU-CVE-2025-23394","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed  cyrus-imapd before 3.8.4-2.1.","status":"published","published":"2025-05-26T16:15:00Z","modified":"2026-10-17T12:56:48.908788618Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"openSUSE-SU-2025:15038-1","title":"cyradm-3.8.4-2.1 on GA media","description":"These are all security issues fixed in the cyradm-3.8.4-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-29T00:00:00Z","modified":"2026-02-04T03:35:35.664152Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:20962-1","title":"Security update for cyrus-imapd","description":"This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\n- cyrus-imapd don't start because of missing \"Requires=var-run.mount\" from systemd (bsc#1251788)\n  Remove var-run.mount from Requires and After\n\n- update to version 3.8.6 (bugfix release)\n  VUL-0: CVE-2025-49812: cyrus-imapd: Opossum Attack Application Layer\n  Desynchronization using Opportunistic TLS (bsc#1246165)\n  The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of\n  implicit TLS over a dedicated port.  STARTTLS is now disabled by default.\n  * Fixed issue #5477: master: tighten up pidfile/etc handling (bsc#1241543)\n    VUL-0: cyrus-imapd: privilege drop happens too late, opening attack vectors from cyrus to root\n  * Fixed issue #5450: fix zoneinfo_db code for GCC 15 (thanks Yadd)\n  * Fixed issue #5309: deadlock on shutdown (thanks Mark Cammidge)\n  * Fixed issue #5424: recognise service-specific SASL options in\n    ``cyr_info conf-lint``\n  * Fixed issue #5420: fix double-free in http_admin (thanks Wolfgang Breyha)\n  * Fixed issue #5460: pop3d: add basic prometheus support (thanks Wolfgang\n    Breyha)\n  * Fixed issue #5454: httpd fails to parse OpenSSL version for status string\n\n- update to version 3.8.5 (bugfix release)\n  * Fixed Issue #5029: check for unexpected extra tiny-tests directories\n  * Fixed Issue #5148: added --enable-release-checks configure option for use when building releases\n  * Fixed Issue #4489: calendar-color \"changes\" namespace (thanks Дилян Палаузов)\n  * Fixed Issue #5009: various portability warnings and nits\n  * Fixed Issue #5050: iTIP line endings (thanks Дилян Палаузов)\n  * Fixed Issue #5052: iMIP line endings (thanks Дилян Палаузов)\n  * Fixed Issue #5072: http_cgi use after free (thanks Дилян Палаузов)\n  * Fixed Issue #5094: httpd crash when PROPFIND url is /dav/calendars\n  * Fixed Issue #5118: broken language checks for \"zr-hant\" and \"sr-me\"\n  * Fixed Issue #5047: proxying UID SEARCH\n\n- CVE-2025-23394: cyrus-imapd: daily-backup.sh allows escalation from cyrus to root (bsc#1241536)\n","status":"published","published":"2026-06-12T18:46:10Z","modified":"2026-06-16T18:24:41.424217747Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}