Path Traversal in Horde IMP Email Client

Executive Summary

CVE-2026-58451 is a path traversal vulnerability in Horde IMP versions before 7.0.1, specifically in the lib/Compose.php file. It allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences (like ../) after a CKEditor path prefix in image source URLs within composed emails.

The vulnerability arises because the application uses a weak prefix validation method (stripos()) and path reconstruction (str_replace()) that fail to properly block traversal sequences. Attackers can bypass these checks and cause the file_get_contents() function to read sensitive files, which are then exfiltrated as MIME parts in outgoing emails.

Additionally, unauthenticated exploitation is possible via Cross-Site Request Forgery (CSRF) attacks targeting an active authenticated session.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to access and read arbitrary sensitive files on the server hosting the Horde IMP application. The contents of these files can be exfiltrated by embedding them in outgoing emails, potentially exposing confidential information.

Because the attack can be performed by authenticated users or via CSRF against authenticated sessions, it increases the risk of unauthorized data disclosure without requiring direct server access.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying attempts to exploit the path traversal flaw in Horde IMP's Compose.php by looking for maliciously crafted <img src> URLs containing traversal sequences after the /ckeditor/ prefix.

On the network or system, you can monitor outgoing emails for MIME parts containing unexpected file contents that may indicate exfiltration of sensitive files.

Additionally, inspecting web server logs for HTTP requests with img src parameters containing traversal sequences (e.g., ../) after the /ckeditor/ path prefix can help detect exploitation attempts.

Suggested commands include using grep or similar tools on web server access logs to find suspicious img src URLs, for example:

• grep -E 'img src=.*\/ckeditor\/.*\.\.\/' /var/log/apache2/access.log
• grep -i 'Content-Type: multipart' /var/mail/* | less # To inspect outgoing emails for suspicious MIME parts

Monitoring for CSRF attempts targeting authenticated sessions may also be useful, though specific commands depend on your environment and logging setup.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation step is to upgrade Horde IMP to version 7.0.1 or later, which contains the fix for this path traversal vulnerability.

The fix enforces strict validation of img src URLs in the Compose.php file, rejecting traversal sequences, NUL bytes, and non-allowlisted characters, and ensuring file access is confined to the CKEditor directory.

If upgrading immediately is not possible, consider restricting access to the vulnerable Compose.php functionality, disabling image embedding features temporarily, or applying custom input validation to block traversal sequences in img src URLs.

Also, ensure that authenticated sessions are protected against CSRF attacks by implementing or verifying existing CSRF protections.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to read arbitrary files from the server filesystem and exfiltrate sensitive file contents via outgoing emails. This unauthorized access and potential exposure of sensitive data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over the confidentiality and integrity of personal and sensitive information.

Since the vulnerability enables exfiltration of sensitive files, organizations using affected versions of Horde IMP may face compliance risks related to unauthorized data disclosure and inadequate protection of sensitive information.

Useful 0 Not Useful 0