Threat Intelligence Database

CVE-2026-65053 is a cross-site scripting (XSS) vulnerability in Horde IMP's AppleDouble MIME viewer. It occurs because an attacker-controlled attachment name is written into an HTML status block without proper escaping, allowing script execution in the context of any user who views the crafted message. The vulnerability affects versions prior to 7.2.0, which introduced escaping to mitigate the issue. Exploitation requires only the ability to send mail to a user and no account on the target system. The vulnerability can be chained with another flaw (CVE-2026-58451) to escalate to code execution in an administrator's session.

Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.