CVE-2026-33606

Deferred Deferred - Pending Action

Dsync Command Injection in Open-Xchange

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: Open-Xchange

Description

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-33606

EUVD

EUVD-2026-67661

Affected Vendors & Products

Vendor	Product	Version / Range
open-xchange	dsync	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability allows a user to craft malicious mail content that is interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol. This can modify mailbox state during migration or replication, including internal attributes a user should not control. It may also cause dsync errors.

Detection Guidance

Detecting this vulnerability requires checking for dsync stream protocol usage on mailboxes with untrusted content. Review mailbox logs for dsync operations with the stream protocol and inspect mail content for crafted entries that resemble dsync commands.

Impact Analysis

An attacker could exploit this to alter mailbox settings or cause errors during system migrations or replication processes. This could disrupt email services or lead to data inconsistencies.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to mailbox state during migration or replication. Untrusted content could alter internal mailbox attributes, which may lead to improper handling of sensitive data. This could result in violations of data integrity or confidentiality requirements under these regulations.

Mitigation Strategies

Avoid running dsync with the stream protocol on mailboxes containing untrusted content. Update to a non-vulnerable version of the software immediately to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-33606. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70