CVE-2026-65053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65053", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-21T14:05:53.719Z", "datePublished": "2026-08-24T14:53:43.219Z", "dateUpdated": "2026-08-29T11:47:32.704Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-29T11:47:32.704Z"}, "datePublic": "2026-08-05T00:00:00.000Z", "title": "Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name", "descriptions": [{"lang": "en", "value": "Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"vendor": "horde", "product": "imp", "repo": "https://github.com/horde/imp", "packageURL": "pkg:github/horde/imp", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "7.2.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:horde:horde_imp:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.2.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "references": [{"url": "https://www.horde.org/apps/imp", "tags": ["product"]}, {"url": "https://github.com/horde/imp/commit/f31449a12e3f945c90015d29524925c4c43f6324", "tags": ["patch"]}, {"url": "https://github.com/horde/imp/pull/107", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/horde/imp/releases/tag/v7.2.0", "name": "Horde IMP v7.2.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://blog.evan.lat/posts/CVE-2026-65053/", "tags": ["technical-description", "exploit"]}, {"name": "VulnCheck Advisory: Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/horde-imp-before-stored-cross-site-scripting-via-appledouble-viewer-part-name"}], "credits": [{"lang": "en", "value": "evan", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T15:45:23.334578Z", "id": "CVE-2026-65053", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T16:15:17.309Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2026/Aug/115"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-26T18:37:24.209Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2026/Aug/115"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-26T18:37:24.209Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65053", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:45:23.334578Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:45:28.377Z"}}], "cna": {"title": "Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name", "credits": [{"lang": "en", "type": "finder", "value": "evan"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://github.com/horde/imp", "vendor": "horde", "product": "imp", "versions": [{"status": "affected", "version": "0", "lessThan": "7.2.0", "versionType": "semver"}], "packageURL": "pkg:github/horde/imp", "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T00:00:00.000Z", "references": [{"url": "https://www.horde.org/apps/imp", "tags": ["product"]}, {"url": "https://github.com/horde/imp/commit/f31449a12e3f945c90015d29524925c4c43f6324", "tags": ["patch"]}, {"url": "https://github.com/horde/imp/pull/107", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/horde/imp/releases/tag/v7.2.0", "name": "Horde IMP v7.2.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://blog.evan.lat/posts/CVE-2026-65053/", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulncheck.com/advisories/horde-imp-before-stored-cross-site-scripting-via-appledouble-viewer-part-name", "name": "VulnCheck Advisory: Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:horde:horde_imp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-29T11:47:32.704Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65053", "state": "PUBLISHED", "dateUpdated": "2026-08-29T11:47:32.704Z", "dateReserved": "2026-07-21T14:05:53.719Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T14:53:43.219Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/horde/imp", "product": "imp", "repo": "https://github.com/horde/imp", "vendor": "horde", "versions": [{"lessThan": "7.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path."}, {"lang": "es", "value": "El visor MIME AppleDouble de Horde IMP escribe un nombre de archivo adjunto controlado por el atacante en un bloque de estado HTML sin escaparlo. En lib/Mime/Viewer/Appledouble.php, _IMPrender() obtiene el nombre de la parte de datos con IMP_Contents::getPartName(), que devuelve el propio par\u00e1metro de nombre de la parte MIME tal como lo proporciona el mensaje, y lo pasa a trav\u00e9s de sprintf al texto de un objeto IMP_Mime_Status. IMP_Mime_Status::__toString() concatena cada entrada de texto directamente en el marcado de la tabla circundante, por lo que el valor llega a la p\u00e1gina renderizada textualmente. Un mensaje elaborado como multipart/appledouble cuya parte de datos lleva marcado en su par\u00e1metro de nombre, por lo tanto, ejecuta script en el contexto de cualquier usuario que lo vea, y la carga \u00fatil persiste en el buz\u00f3n. La explotaci\u00f3n no requiere una cuenta en el sistema objetivo, solo la capacidad de enviar correo a un usuario. La versi\u00f3n 7.2.0 escapa el valor con htmlspecialchars(). El investigador adem\u00e1s encadena esta falla con la lectura arbitraria de archivos de CVE-2026-58451, y reporta que el script ejecut\u00e1ndose en la sesi\u00f3n de un administrador puede alcanzar una ruta de ejecuci\u00f3n de c\u00f3digo de aplicaci\u00f3n."}], "id": "CVE-2026-65053", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65053", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T15:45:23.334578Z", "version": "2.0.3"}}]}, "published": "2026-08-24T15:16:39.380", "references": [{"source": "disclosure@vulncheck.com", "url": "https://blog.evan.lat/posts/CVE-2026-65053/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/horde/imp/commit/f31449a12e3f945c90015d29524925c4c43f6324"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/horde/imp/pull/107"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/horde/imp/releases/tag/v7.2.0"}, {"source": "disclosure@vulncheck.com", "url": "https://www.horde.org/apps/imp"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/horde-imp-before-stored-cross-site-scripting-via-appledouble-viewer-part-name"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2026/Aug/115"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "horde_imp", "vendor": "horde"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "imp", "source": "cna", "vendor": "horde"}, "product": "imp", "vendor": "horde"}], "created": "2026-08-24T18:00:04.654508+00:00", "updated": "2026-08-24T20:00:04.391673+00:00", "vendors": ["horde", "horde$PRODUCT$horde_imp", "horde$PRODUCT$imp"]}