CVE-2026-112353: GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI KerioConnectto a version that resolves this vulnerability.Fixed in 10.0.8 Patch 2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using GFI KerioConnect versions earlier than 10.0.8 Patch 2 are affected in the Webmail component. Exploitation targets authenticated Webmail users who open a crafted SVG email attachment.
What does an attacker need to exploit it?
An attacker can remotely upload or send a crafted SVG email attachment containing event-handler attributes that bypass sanitization. The victim must open the attachment through Webmail's temporary-download endpoint.
What can happen if exploitation succeeds?
JavaScript can execute in the victim's authenticated Webmail session. The described impact includes theft of credentials and mailbox contents, and exploitation has been observed in the wild for those purposes.
What version resolves the issue?
Upgrade to GFI KerioConnect 10.0.8 Patch 2 or later. Versions before 10.0.8 Patch 2 are identified as vulnerable.