CVE-2026-65053
Received Received - Intake

Stored XSS in Horde IMP via AppleDouble MIME Viewer

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-65053
EUVD
EUVD-2026-64899

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
horde imp 7.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65053 is a stored Cross-Site Scripting (XSS) vulnerability in Horde IMP's AppleDouble MIME viewer. It occurs when an attacker sends an email with a malicious attachment name containing script code. When the email is viewed, the script executes in the user's browser without requiring authentication. The flaw exists because the application fails to escape the attachment name before rendering it in the HTML status block.

Detection Guidance

Detecting this vulnerability requires checking the Horde IMP version and inspecting email content for malicious payloads. Verify if your system runs Horde IMP versions before 7.2.0. Inspect emails with multipart/appledouble attachments for scripts in attachment names. Use server logs to identify unusual file reads or script executions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in the context of a user's session by sending a specially crafted email. It can lead to session hijacking, theft of sensitive data, or further exploitation. If chained with other vulnerabilities like CVE-2026-58451, it may enable remote code execution, allowing full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The stored XSS flaw allows attackers to inject malicious scripts that could exfiltrate data or gain elevated privileges, potentially exposing regulated data to unauthorized parties.

Mitigation Strategies

Upgrade Horde IMP to version 7.2.0 or later immediately. Block or quarantine emails with suspicious multipart/appledouble attachments. Monitor for unauthorized file access or script execution. Apply patches for related vulnerabilities like CVE-2026-58451 if present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65053. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart