CVE-2026-33606

A flaw was found in Dovecot. A malicious user can craft specific mail content that, when an administrator later uses the dsync tool with the stream protocol, is interpreted as dsync commands. This command injection allows the user to modify the state of mailboxes on the destination, including...