CVE-2026-97735
Received Received - Intake

SVG Attachment Bypass in ITFlow Email Parser

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: MITRE

Description
ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97735
EUVD
EUVD-2026-86514

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itflow itflow to 26.08 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ITFlow before version 26.08 has a vulnerability where SVG attachments are allowed in the ticket email parser. This parser processes email messages received over SMTP from any sender, potentially allowing malicious SVG files to be processed.

Detection Guidance

Check ITFlow configuration files for allowed attachments in cron/ticket_email_parser.php. Look for 'svg' in the $allowed_extensions array. Verify app_version.php shows version 26.08 or later.

Impact Analysis

This vulnerability could allow attackers to send malicious SVG files via email, which may lead to unauthorized code execution, data theft, or system compromise if the SVG is processed by the vulnerable ITFlow instance.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected ITFlow versions may face compliance violations and penalties.

Mitigation Strategies

Update ITFlow to version 26.08 or later to remove SVG support in ticket email parser. Review email attachments for SVG files and block them at the mail server level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart