This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Alinto SOGo's handling of ICS calendar invitation files. Specifically, SVG content embedded in the description field of an ICS file includes an onrepeat event handler that is not properly sanitized before rendering in the webmail interface. This allows remote attackers to execute arbitrary JavaScript code within the context of an authenticated user's session when the malicious calendar invite is viewed. The vulnerability affects version 5.12.7 of SOGo. There is no CVSS score or vendor advisory indicating patch availability or mitigation status.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of an authenticated user's webmail session. This can lead to mailbox access, theft of emails and contacts, session hijacking, and other actions permitted by the user's privileges. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening ICS calendar invitations from untrusted sources. There is no vendor advisory indicating that the issue is already mitigated or that no action is required.