Executive brief
Alinto SOGo is an open-source collaborative software server used for email, calendaring, and contacts. A security vulnerability in the way it handles calendar invitations allows an attacker to execute malicious code in a user's browser when they view a specially crafted invite. This could lead to unauthorized access to the user's mailbox, theft of sensitive emails and contacts, or the hijacking of their active session.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Alinto SOGo version 5.12.7 and earlier. The issue resides in the UIxMailPartICalViewer component, which fails to sufficiently sanitize SVG content embedded within the description field of ICS (calendar) files. Specifically, the application does not properly filter 'onrepeat' event handlers within SVG tags. An unauthenticated remote attacker can exploit this by sending a malicious calendar invitation to a victim; when the victim views the invitation in the SOGo webmail interface, the embedded JavaScript executes in the context of their session. This can result in session hijacking, data exfiltration, or unauthorized actions performed on behalf of the user. The vulnerability is addressed in version 5.12.8.
Affected products
- Alinto SOGo 5.12.7 and all versions prior to 5.12.8
Timeline
- 2026-05-08: patched: Fix available in nightly builds
- 2026-05-12: advisory: Vendor release announcement for SOGo v5.12.8
- 2026-05-13: disclosed: CVE published to NVD