The vulnerability exists in a script that converts email attachments into plain text for full‑text search. The script uncritically processes zip‑style attachments, allowing a malicious OOXML document to create arbitrary files on the server. Those files are then indexed by the FTS engine, making them discoverable. This presents an information‑exposure risk (CWE‑200) because an attacker can cause sensitive files to appear in search results.

This issue affects the Open‑Xchange GmbH OX Dovecot Pro product. Any installation that includes the default attachment conversion script is potentially impacted. The advisory does not specify version ranges, so all current releases using this script are considered vulnerable.

The CVSS base score is 4.3, indicating moderate severity. EPSS data is not available and no public exploits are documented. The vulnerability is not in the KEV list. Exploitation requires an attacker to send a specially crafted OOXML attachment that the server processes. The attack vector is therefore internal email handling; it does not provide remote code execution but enables unauthorized file indexing.