Improper input validation in isync/mbsync
Priority LOW 36CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.
Why it matters now
EPSS 0.0188 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed isync/mbsync: 1.35, 1.4.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | isync/mbsync | before 1.35; before 1.4.1 | 1.35, 1.4.1 | Patch available | CNA |
- isync/mbsync Vendor— Affected before 1.35; before 1.4.1 Fixed in 1.35, 1.4.1 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mbsync_project:mbsync:*:*:*:*:*:*:*:* | before 1.3.5; 1.4.0 to before 1.4.1 | Vulnerable | Mbsync Project |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:mbsync_project:mbsync:*:*:*:*:*:*:*:* Versions before 1.3.5; 1.4.0 to before 1.4.1 Vulnerable ·Mbsync Project
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA isync/mbsync Fixed in 1.35, 1.4.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20247
- 2026-10-03 Alias added: GHSA-5cp5-w68m-9w38
References
Sources
- CVE-2021-20247 · CVE Program
- CVE-2021-20247 · NVD
- FIRST EPSS
- GHSA-5cp5-w68m-9w38 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-20247 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences