CVE-2026-58451
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Horde IMP before version 7.0.1 contains a path traversal vulnerability in lib/Compose.php. An authenticated attacker can read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. The attacker bypasses the stripos() prefix validation by appending traversal sequences after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing emails; unauthenticated exploitation is also possible via CSRF against an active authenticated session.
Risk Assessment
The risk for the organization includes leakage of confidential data such as configuration files, passwords, or user data read from the server filesystem. An attacker can exploit this vulnerability to steal sensitive information, potentially leading to data breaches and further attacks.
Recommendation
It is recommended to immediately upgrade Horde IMP to version 7.0.1 or later, which includes a fix for this vulnerability. Additionally, implement CSRF protection mechanisms such as anti-CSRF tokens and restrict access to the compose functionality to trusted users only.
Other vulnerabilities in Horde IMP
Original NVD description (English source)
Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.