CVE-2026-58451 is a path traversal vulnerability in Horde IMP before version 7.0.1, specifically in lib/Compose.php. The issue arises because the application improperly limits pathname access to a restricted directory. Attackers can bypass prefix validation by appending traversal sequences after a CKEditor path prefix in image source URLs, causing file_get_contents() to read arbitrary server files. The exfiltrated file contents are then included as MIME parts in outgoing emails. The vulnerability requires an authenticated user but can be exploited without direct authentication via CSRF against an active session.

Successful exploitation allows attackers to read arbitrary files on the server filesystem, potentially exposing sensitive information. The exfiltration of file contents occurs through outgoing email MIME parts, which could lead to data leakage. The vulnerability can be exploited by authenticated users or via CSRF attacks without direct authentication, increasing the risk of unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious email activity that may indicate exploitation attempts. Consider disabling or limiting the use of CKEditor image uploads if feasible.