Is CVE-2026-78061 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78061 being exploited in the wild.

How severe is CVE-2026-78061?

Medium severity, with a CVSS score of 6.3, published 23 August 2026.

Is there a fix for CVE-2026-78061?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78061 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78061?

Check whether you run Vas3k TaxHacker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78061: vas3k TaxHacker server-side request forgery in IMAP configuration

CVE-2026-78061 · Severity: medium · CVSS 6.3 · Published 2026-08-23

TaxHacker is a self-hosted AI accounting application that analyzes receipts and invoices. The email synchronization feature allows users to configure custom IMAP email servers but fails to validate the host and port parameters, enabling an attacker to craft a malicious server configuration that forces the application to make network connections to internal or arbitrary systems. This can be exploited to scan internal networks, fingerprint services, or bypass firewalls.

Technologies: Vas3k TaxHacker. Vendors: Vas3k.

Quick answers

Is CVE-2026-78061 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78061 being exploited in the wild.
How severe is CVE-2026-78061?: Medium severity, with a CVSS score of 6.3, published 23 August 2026.
Which products and versions are affected?: Vas3k TaxHacker up to 0.8.2.
Is there a fix for CVE-2026-78061?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78061 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78061?: Check whether you run Vas3k TaxHacker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability exists in the email sync component of TaxHacker, specifically in the buildImapConfig() function (lib/email-sync/imap-client.ts). The addEmailServerAction() function in app/(app)/apps/email/actions.ts accepts user-controlled host and port parameters without validation and stores them in the database. When email synchronization is triggered or when testImapConnection() is called, these untrusted parameters are passed directly to the imap-simple library's imaps.connect() method, which establishes a TCP connection to the attacker-specified host and port. An authenticated user can exploit this to perform SSRF attacks against internal services, scan internal networks, or fingerprint running services. The vulnerability requires authentication to exploit (PR:L in CVSS vector) and results in information disclosure through connection probing. A fix has been proposed but not yet merged into the codebase.

Affected products

vas3k TaxHacker up to 0.8.2

Timeline

2026-08-23: disclosed
2026-07-07: other: Issue opened on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.