Alinto SOGo, an open-source webmail and groupware platform, suffers from a cross-site scripting vulnerability (CWE-79) in its handling of ICS calendar invitation files. The DESCRIPTION field in ICS files is rendered without proper sanitization or Content Security Policy enforcement, allowing malicious SVG payloads with JavaScript event handlers to execute in the context of the SOGo webmail interface. This occurs during normal calendar rendering, without user interaction. Exploitation enables attackers to gain full read access to the victim's mailbox, including credentials and sensitive data. The vulnerability is addressed in SOGo version 5.12.8 by sanitizing the DESCRIPTION field and improving SVG/HTML handling.

Successful exploitation allows remote attackers to execute arbitrary scripts in the victim's browser context when viewing calendar invitations, leading to credential theft, forced phishing logins, password manager hijacking, and full exfiltration of email messages, folders, contacts, and calendar data. This compromises user confidentiality and privacy but does not impact availability.

Users should upgrade to Alinto SOGo version 5.12.8 or later, which includes fixes that sanitize ICS DESCRIPTION content and enforce stricter handling of embedded SVG and HTML to prevent this XSS vulnerability. No other mitigation is required as the patch fully addresses the issue.