When the safe filter is combined with variable expansion, the system mistakenly treats any subsequent pipeline expressions on the same string as safe as well. This flaw allows unsanitized data to be unescaped. Attackers can exploit this behavior to inject arbitrary SQL or LDAP commands through authentication mechanisms, potentially compromising data confidentiality, integrity, or availability. The weakness is a CWE‑235 "Improper Neutralization of Input During Runtime" flaw.

The vulnerability affects Open‑Xchange GmbH’s OX Dovecot Pro software. No specific version ranges are listed in the advisory, so any deployed instance of this product may be susceptible until a fix is applied.

The CVSS score of 7.4 places this issue in the high‑severity tier. Although the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, the potential for injection in authentication suggests that a remote attacker could exploit it via the public authentication interface. No public exploits have been reported, but the underlying mechanism provides a straightforward exploitation path once an attacker can craft credentials containing injected commands.