Skip to content
Fencer Vulns
high 7.4

CVE-2021-20247 json

A flaw was found in mbsync before v1.3.5 and v1.4.1.

published 2021-02-23 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-7686

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Patch / fix

  • mbsync_project mbsync 1.3.5, 1.4.1
  • isync Debian 14, Debian 13, Debian 12 1.3.0-2.1

debian advisories DEBIAN-CVE-2021-20247

  • isync openSUSE Tumbleweed 1.4.3-1.2
  • isync Package Hub 15 SP2 1.3.5-bp152.4.3.1
  • isync openSUSE Leap 15.2 1.3.5-lp152.4.3.1

opensuse advisories openSUSE-SU-2024:10866-1openSUSE-SU-2021:0533-1openSUSE-SU-2021:0516-1

  • isync Alpine 3.13 1.3.5-r0
  • isync Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.4.1-r0

alpine advisories ALPINE-CVE-2021-20247

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • isync Arch Linux 1.3.5-1

arch linux advisories AVG-1598

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20247 updated cvss 6.8

isync/mbsync: mailbox names returned by IMAP LIST/LSUB not validated

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.88% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • openwall.com https://www.openwall.com/lists/oss-security/2021/02/22/1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • n/a isync/mbsync

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.