CVE-2026-65053: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in horde imp

Horde IMP's AppleDouble MIME viewer improperly neutralizes input during web page generation by inserting an attacker-controlled attachment name directly into an HTML status block without escaping. Specifically, in lib/Mime/Viewer/Appledouble.php, the _IMPrender() function uses IMP_Contents::getPartName() to retrieve the MIME part's name parameter from the message and passes it into an IMP_Mime_Status object via sprintf. The IMP_Mime_Status::__toString() method concatenates this text directly into HTML markup, resulting in the raw value being rendered verbatim. A crafted multipart/appledouble message with malicious markup in the name parameter can execute script in any user’s browser who views the message, with the payload persisting in the mailbox. Version 7.2.0 fixes this by applying htmlspecialchars() escaping. The researcher also demonstrated chaining this XSS with CVE-2026-58451 (arbitrary file read) to achieve application code execution in an administrator's session. Exploitation requires no privileges other than sending mail to a user.

Successful exploitation allows an attacker to execute arbitrary script in the context of any user who views the crafted email message, potentially leading to session hijacking or other client-side attacks. The payload persists in the mailbox, increasing risk of repeated exploitation. The vulnerability requires no user account on the system, only the ability to send mail to a victim. Additionally, chaining with another vulnerability (CVE-2026-58451) can escalate impact to application code execution in an administrator's session.

Version 7.2.0 of Horde IMP includes a fix that escapes the attacker-controlled attachment name using htmlspecialchars(), preventing script execution. Users should upgrade to version 7.2.0 or later to remediate this vulnerability. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the description stating the fix in 7.2.0.