CVE-2025-59026

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

• CWE-79

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0003.json

Published

Nov 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59020By exploiting the defVals parameter, attackers could bypass …6.5
• CVE-2025-59021Backend users with access to the redirects module and write …6.4
• CVE-2025-59022Backend users who had access to the recycler module could de…8.1
• CVE-2025-59023Crafted delegations or IP fragments can poison cached delega…8.2
• CVE-2025-59024Crafted delegations or IP fragments can poison cached delega…6.5
• CVE-2025-59025Malicious e-mail content can be used to execute script code.…6.1
• CVE-2025-59028When sending invalid base64 SASL data, login process is disc…7.5
• CVE-2025-59029An attacker can trigger an assertion failure by requesting c…5.3
• CVE-2025-5903A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It h…8.8
• CVE-2025-59030An attacker can trigger the removal of cached records by sen…7.5
• CVE-2025-59031Dovecot has provided a script to use for attachment to text …4.3
• CVE-2025-59032ManageSieve AUTHENTICATE command crashes when using literal …7.5