CVE-2026-112356: GFI KerioConnect < 10.0.9p2 HTML Injection via Link Auto-Formatter
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains an HTML injection vulnerability that allows remote attackers to inject malicious markup by crafting emails whose link text contains quote characters, causing the Webmail auto-formatter to break out of the href attribute while re-processing text already inside a link. Attackers can exploit this flaw to spoof link targets or inject arbitrary HTML into the rendered message within a victim's Webmail session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI KerioConnectto a version that resolves this vulnerability.Fixed in 10.0.9 Patch 2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who view attacker-crafted email in the Kerio Connect Webmail interface are exposed. The vulnerable behavior occurs when Webmail re-processes link text containing quote characters.
What does an attacker need to exploit it?
An attacker needs to send a crafted email with link text containing quote characters and have a victim view the rendered message in Webmail. No attacker authentication is indicated, but victim interaction is required.
Are installations running the affected release range vulnerable by default?
The provided information identifies Kerio Connect versions before 10.0.9 Patch 2 as affected, but does not state whether any configuration changes are required or whether the behavior is enabled by default.
What is the impact if exploitation succeeds?
An attacker can spoof link destinations or inject arbitrary HTML into the rendered email message in the victim's Webmail session. The listed impact includes low confidentiality and integrity effects, with no availability impact.