Description

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-24T15:16:39.380Z",
  "pubdate": "2026-08-24T15:16:39.380Z",
  "executiveSummary": "Horde IMP suffers from a Stored Cross-Site Scripting (XSS) vulnerability within its AppleDouble MIME viewer component. The flaw arises due to improper output neutralization of attacker-controlled attachment names prior to rendering them within an HTML status block. An unauthenticated remote attacker capable of sending an email message to a victim can exploit this vulnerability without requiring a local account on the target system. By crafting a malicious multipart/appledouble MIME message containing executable script tags or JavaScript payloads inside the filename parameter of the data part, an attacker can force arbitrary script execution within the browser context of any user who views the affected message. Because the malicious payload is stored directly within the email data structure, the attack payload persists within the mailbox across sessions. Furthermore, when combined with supplementary vulnerabilities such as the arbitrary file read designated by CVE-2026-58451, execution of script code within an administrator session can facilitate access to application code-execution pathways, significantly escalating the overall risk profile and potential organizational impact.",
  "technicalDetails": "The vulnerability resides in the AppleDouble MIME viewer component of Horde IMP, specifically implemented within the file lib/Mime/Viewer/Appledouble.php. The root cause of the flaw is a lack of proper contextual output encoding when handling user-supplied metadata from incoming email messages. During the rendering phase, the _IMPrender() function retrieves the attachment or data part name utilizing the IMP_Contents::getPartName() method. This method extracts the MIME part's raw name parameter directly from the incoming message structure without validation or sanitization. The extracted string is subsequently injected via a sprintf formatting operation into the text representation managed by an IMP_Mime_Status object. When the underlying IMP_Mime_Status::__toString() magic method is invoked, it concatenates each text entry directly into the surrounding HTML table markup without applying HTML entity encoding, causing the raw string to reach the client-side rendered DOM verbatim.\nTo exploit this vector, an attacker crafts and transmits a malicious email message structured as a multipart/appledouble MIME type. The data subpart within this MIME structure carries an arbitrary JavaScript payload embedded within its name attribute parameter. When a victim retrieves and views the manipulated message within Horde IMP, the application processes the AppleDouble viewer logic and embeds the unescaped name parameter directly into the dynamic status block markup. The malicious script payload is subsequently executed within the security context of the victim's active browser session. Because the malicious content is embedded directly into the MIME part parameters stored by the messaging backend, the payload exhibits persistence within the targeted mailbox, triggering the XSS condition every subsequent time the message is accessed.\nThe attack vector requires no prior authentication or user accounts on the target messaging infrastructure; the sole prerequisite is the ability to successfully deliver an email message to the target user. Affected software configurations include Horde IMP prior to version 7.2.0. In post-exploitation scenarios, the impact is severely exacerbated if chained with other application vulnerabilities. Specifically, when chained with the arbitrary file read vulnerability referenced as CVE-2026-58451, an attacker who successfully achieves execution of arbitrary script code within the session of a high-privileged administrator can leverage the compounded flaws to reach underlying application code-execution pathways, leading to complete compromise of the affected web application environment."
}