CVE-2026-58451: Horde IMP < 7.0.1 Path Traversal via Compose.php img src
Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing filegetcontents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Horde IMPto a version that resolves this vulnerability.Fixed in 7.0.1 - Compensating control
Mitigate unauthenticated exploitation by CSRF against an active authenticated session using CSRF protections appropriate to the Horde IMP deployment (e.g., ensure CSRF tokens/validations are enforced and that CSRF attempts are blocked for the vulnerable Compose.php img src functionality).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58451?
CVE-2026-58451 has a medium severity rating of 6.5.
How do I fix CVE-2026-58451?
To resolve CVE-2026-58451, upgrade to Horde IMP version 7.0.1 or later.
What type of vulnerability is CVE-2026-58451?
CVE-2026-58451 is a path traversal vulnerability.
What can an attacker do with CVE-2026-58451?
An authenticated attacker can exploit CVE-2026-58451 to read arbitrary files from the server filesystem.
Which software is affected by CVE-2026-58451?
CVE-2026-58451 affects versions of Horde IMP prior to 7.0.1.