Horde IMP's AppleDouble MIME viewer improperly neutralizes input during web page generation by writing an attacker-controlled attachment name directly into an HTML status block without escaping. The vulnerability resides in lib/Mime/Viewer/Appledouble.php where the _IMPrender() function obtains the MIME part's name parameter and passes it through sprintf into an IMP_Mime_Status object. The __toString() method of IMP_Mime_Status concatenates this text directly into HTML markup, resulting in the injection of unescaped attacker-controlled markup. This allows an attacker to execute arbitrary scripts in the context of any user viewing the message. The flaw is fixed in version 7.2.0 by applying htmlspecialchars() to escape the value. The researcher also demonstrated chaining this XSS with CVE-2026-58451 to achieve application code execution in an administrator's session. Exploitation requires no user account, only the ability to send mail to a target user.

An attacker can execute arbitrary scripts in the context of any user who views a crafted email message, leading to persistent cross-site scripting in the mailbox. This can result in session hijacking, credential theft, or other malicious actions within the user's session. Additionally, when chained with another vulnerability (CVE-2026-58451), it can lead to application code execution in an administrator's session, significantly increasing the impact.

Upgrade to Horde IMP version 7.2.0 or later, where the vulnerability is fixed by escaping the attachment name with htmlspecialchars(). No other mitigation is indicated or required by the vendor advisory. Patch status is not explicitly stated but the fix is included in version 7.2.0.