Dovecot’s attachment conversion script mishandles zip‑style OOXML documents, allowing an attacker to inject unintended local files into the full‑text search index. This leads to the exposure of potentially sensitive data through the FTS mechanism, representing an information disclosure vulnerability rooted in improper parsing of XML (CWE‑611) and a broader information exposure (CWE‑200).

The flaw impacts Open‑Xchange GmbH’s OX Dovecot Pro product. No specific affected revision numbers are listed, so any deployment that utilizes the default attachment conversion script is potentially vulnerable.

The calculated CVSS score of 4.3 classifies the issue as low severity, and an EPSS score below 1% indicates a very low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply crafted OOXML attachments processed by the script; no public exploits are known at this time.