Vulnerability-Lookup

GHSA-8WPM-P8H2-X7WH

Vulnerability from github – Published: 2026-08-24 15:31 – Updated: 2026-08-24 15:31

Details

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-65053"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-24T15:16:39Z",
    "severity": "MODERATE"
  },
  "details": "Horde IMP\u0027s AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part\u0027s own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator\u0027s session can reach an application code-execution path.",
  "id": "GHSA-8wpm-p8h2-x7wh",
  "modified": "2026-08-24T15:31:55Z",
  "published": "2026-08-24T15:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65053"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horde/imp/pull/107"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horde/imp/commit/f31449a12e3f945c90015d29524925c4c43f6324"
    },
    {
      "type": "WEB",
      "url": "https://blog.evan.lat/posts/CVE-2026-65053"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horde/imp/releases/tag/v7.2.0"
    },
    {
      "type": "WEB",
      "url": "https://www.horde.org/apps/imp"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/horde-imp-before-stored-cross-site-scripting-via-appledouble-viewer-part-name"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-65053 (GCVE-0-2026-65053)

Vulnerability from cvelistv5 – Published: 2026-08-24 14:53 – Updated: 2026-08-24 14:53

Title

Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Summary

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://www.horde.org/apps/imp	product
https://github.com/horde/imp/commit/f31449a12e3f9…	patch
https://github.com/horde/imp/pull/107	issue-tracking
https://github.com/horde/imp/releases/tag/v7.2.0	release-notes
https://blog.evan.lat/posts/CVE-2026-65053/	technical-descriptionexploit
https://www.vulncheck.com/advisories/horde-imp-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
horde	imp	Affected: 0 , < 7.2.0 (semver) cpe:2.3:a:horde:horde_imp::::::::

Date Public

2026-08-05 00:00

Credits

evan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/horde/imp",
          "product": "imp",
          "repo": "https://github.com/horde/imp",
          "vendor": "horde",
          "versions": [
            {
              "lessThan": "7.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:horde:horde_imp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "evan"
        }
      ],
      "datePublic": "2026-08-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Horde IMP\u0027s AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part\u0027s own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator\u0027s session can reach an application code-execution path."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T14:53:43.219Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://www.horde.org/apps/imp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/horde/imp/commit/f31449a12e3f945c90015d29524925c4c43f6324"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/horde/imp/pull/107"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/horde/imp/releases/tag/v7.2.0"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://blog.evan.lat/posts/CVE-2026-65053/"
        },
        {
          "name": "VulnCheck Advisory: Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/horde-imp-before-stored-cross-site-scripting-via-appledouble-viewer-part-name"
        }
      ],
      "title": "Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-65053",
    "datePublished": "2026-08-24T14:53:43.219Z",
    "dateReserved": "2026-07-21T14:05:53.719Z",
    "dateUpdated": "2026-08-24T14:53:43.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-8WPM-P8H2-X7WH

CVE-2026-65053 (GCVE-0-2026-65053)

Tags

Sightings

Nomenclature