CVE-2025-23394 daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root
A symlink following vulnerability in the daily-backup.sh script allows local attackers to escalate privileges from the cyrus user to root.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23394?
CVE-2025-23394 is a critical path traversal vulnerability in openSUSE Tumbleweed, published on 26 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
Weakness: CWE-61
Which versions are affected by CVE-2025-23394?
Linux distribution packages (1)
cyrus-imapd openSUSE:Tumbleweed | All versions | 3.8.4-2.1 |
How do I fix CVE-2025-23394?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-23394 being exploited?
There is no known exploitation of CVE-2025-23394 in the wild and no public exploit code.
Sources
Also known as GHSA-q5xr-h2vq-97x6, UBUNTU-CVE-2025-23394, openSUSE-SU-2025:15038-1.