CVE-2026-27851

State: Published
Severity: 7.4 High
Published: May 12, 2026
Updated: Jul 15, 2026
Reserved: Feb 24, 2026

Description

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	OX
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat-SADP

Weaknesses

CWE-235 Improper Handling of Extra Parameters
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
OX Dovecot ProOpen-Xchange GmbH	3.1.4 and earlierAffected 2.4.3 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.