Open-xchange vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-73208 An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audiHigh 7.4 · Aug 28, 2026
• CVE-2026-42391 An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow dispHigh 7.5 · Aug 28, 2026
• CVE-2026-42007 An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write mCritical 9.1 · Aug 28, 2026
• CVE-2026-40018 None None None No publicly available exploits are known.High 7.4 · Aug 28, 2026
• CVE-2026-33605 An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.High 7.5 · Aug 28, 2026
• CVE-2026-27852 An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excesHigh 7.5 · Aug 28, 2026
• CVE-2026-27851 When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to beHigh 7.4 · May 12, 2026
• CVE-2026-27858 Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.High 7.5 · Mar 27, 2026
• CVE-2026-27856 Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack.High 7.4 · Mar 27, 2026
• CVE-2026-24031 Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.High 7.7 · Mar 27, 2026
• CVE-2025-59032 ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.High 7.5 · Mar 27, 2026
• CVE-2025-30189 When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.High 7.4 · Oct 31, 2025
• CVE-2025-30188 Malicious or unintentional API requests can be used to add significant amount of data to caches.High 7.5 · Oct 31, 2025
• CVE-2024-23185 Very large headers can cause resource exhaustion when parsing message.High 7.5 · Sep 10, 2024
• CVE-2023-41704 Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.High 7.1 · Feb 12, 2024
• CVE-2023-29051 User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API.High 8.1 · Jan 8, 2024
• CVE-2023-29050 The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hieHigh 7.6 · Jan 8, 2024
• CVE-2023-29048 A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user.High 8.8 · Jan 8, 2024
• CVE-2022-29851 documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occurCritical 9.8 · Oct 25, 2022
• CVE-2022-24405 OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.Critical 9.8 · Jul 27, 2022
• CVE-2022-23100 OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).Critical 9.8 · Jul 27, 2022
• CVE-2020-28944 OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data.High 7.5 · Apr 30, 2021
• CVE-2020-12645 OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory coCritical 9.8 · Aug 31, 2020
• CVE-2020-8543 OX App Suite through 7.10.3 has Improper Input Validation.High 7.5 · Jun 16, 2020
• CVE-2014-5236 Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remoteHigh 7.5 · Jan 31, 2020