---
id: CVE-2026-27851
title: >-
  When safe filter is used with variable expansion, all following pipelines on
  the same string are incorrectly interpreted as safe too, enabling unsafe data
  to be unescaped
summary: >-
  When safe filter is used with variable expansion, all following pipelines on
  the same string are incorrectly interpreted as safe too, enabling unsafe data
  to be unescaped. This can enable SQL / LDAP injection attacks when used in
  authent…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-235
  - CWE-89
vendor: dovecot
product: dovecot
affected:
  - dovecot < 2.4.4
  - dovecot < 3.1.5
patched:
  - dovecot 3.1.5
published: '2026-05-12'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27851'
references:
  - url: >-
      https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
    label: security@open-xchange.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-27851'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476471'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27851.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00575
epssPercentile: 0.45146
ingestedAt: '2026-07-10T14:03:54.817Z'
---

## Overview

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

## Affected

- `dovecot < 2.4.4`
- `dovecot < 3.1.5`

## Remediation

Upgrade past the affected range:

- `dovecot 3.1.5`