Executive brief
Horde IMP is an open-source email client and groupware suite used by enterprises and universities for messaging, calendar, and collaboration. An attacker can send a specially crafted email with malicious script embedded in an attachment name, which executes in the browser of anyone who views the message. Because the payload persists in the mailbox, the attack remains active for any future viewing and can be chained with other vulnerabilities to achieve administrative compromise or remote code execution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the AppleDouble MIME viewer component (lib/Mime/Viewer/Appledouble.php). The vulnerable code retrieves an attachment name from a MIME message part using getPartName() and passes it unsanitized into an sprintf() call, which then concatenates it directly into HTML table markup without escaping. An attacker can craft a multipart/appledouble email with script tags or event handlers in the data part's name parameter. No authentication is required; exploitation only requires sending mail to a targeted user. The advisory notes this vulnerability can be chained with CVE-2026-58451 (arbitrary file read) to enable unauthenticated RCE via XSS worms that target administrative sessions. Version 7.2.0 fixes the issue by applying htmlspecialchars() escaping to the attachment name.
Affected products
- Horde IMP before 7.2.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: version 7.2.0 includes fix