Description

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-25T04:17:50.763Z",
  "pubdate": "2026-09-25T04:17:50.763Z",
  "executiveSummary": "ITFlow versions prior to 26.08 contain a vulnerability in the ticket email parser that allows for the processing of SVG attachments.\nThis vulnerability is categorized as an improper input validation issue, which can be leveraged to achieve Stored Cross-Site Scripting (XSS).\nThe flaw affects the cron/ticket_email_parser.php component, which handles incoming emails via SMTP.\nBy sending a specially crafted email containing a malicious SVG file, an unauthenticated remote attacker can force the application to store the file on the server.\nWhen a victim, typically an administrator or support staff, views the ticket in the ITFlow interface, the embedded malicious scripts execute within the context of the user's browser session.\nThis may lead to unauthorized actions, session hijacking, or the theft of sensitive session tokens. The risk is considered high due to the lack of authentication required to send the triggering email and the potential impact on privileged users.",
  "technicalDetails": "The vulnerability resides within the cron/ticket_email_parser.php script in ITFlow, which is responsible for parsing incoming emails and automatically generating or updating tickets based on the content.\nThe root cause of this issue is insufficient file type validation and sanitization when the parser processes file attachments from incoming SMTP traffic. Specifically, the system fails to block or sanitize Scalable Vector Graphics (SVG) files.\nUnlike standard image formats such as JPEG or PNG, SVG files are XML-based documents that support embedded scripting, including ECMAScript (JavaScript).\nAn attacker can exploit this by crafting an SVG file containing a malicious payload inside <script> tags or within event handlers like 'onload'. The attacker then sends this file as an email attachment to the address monitored by ITFlow.\nUpon receipt, the cron/ticket_email_parser.php component extracts the attachment and writes it to the application's file storage area without stripping the executable script tags or converting the file into a safer, non-executable image format.\nThe attack flow proceeds as follows: First, the attacker sends an email containing the malicious SVG attachment to the ITFlow parser. Second, the parser saves the malicious file to the filesystem. Third, when a support technician navigates to the ticket management interface in ITFlow, the browser attempts to render or access the uploaded attachment.\nThe execution occurs because the browser interprets the SVG as a legitimate document within the application's origin, allowing the embedded script to run. This context is critical as the script inherits the session permissions of the authenticated support staff or administrator viewing the ticket.\nThe post-exploitation impact includes the potential for session hijacking, unauthorized API calls made on behalf of the victim, and the exfiltration of data visible within the ITFlow dashboard.\nSince the email parser interacts with external SMTP sources, the vulnerability is exposed to remote, unauthenticated attackers who can target the email address linked to the ITFlow instance, bypassing typical web-based authentication mechanisms during the initial injection phase."
}