CVE-2026-65053

MediumCVSS 6.1

Published: 24/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

XSS vulnerability in Horde IMP's AppleDouble MIME viewer allows an attacker to execute script in the context of a user viewing the message, due to improper escaping of the attachment name in an HTML status block.

Risk Assessment

An attacker could execute malicious script in a user's session, potentially leading to data theft or administrator session compromise.

Recommendation

Update Horde IMP to version 7.2.0 or later, which includes the escaping fix.

Other vulnerabilities in Horde IMP

CVE-2026-58451Medium
Horde IMP before version 7.0.1 contains a path traversal vulnerability in lib/Compose.php. An authenticated attacker can read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. The attacker bypasses the stripos() prefix validation by appending traversal sequences after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing emails; unauthenticated exploitation is also possible via CSRF against an active authenticated session.

Original NVD description (English source)

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.