CVE-2026-65053: Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender() obtains the name of the data part with IMPContents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMPMimeStatus object. IMPMimeStatus::toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Horde IMPto a version that resolves this vulnerability.Fixed in 7.2.0 - Configuration
Ensure the attacker-controlled AppleDouble data-part name taken from IMP_Contents::getPartName() is escaped before being concatenated into the IMP_Mime_Status HTML status block (as in v7.2.0, which uses htmlspecialchars()).
Horde IMP AppleDouble MIME viewer Escaping of data part name before rendering = htmlspecialchars()
Event History
Frequently Asked Questions
Which Horde IMP versions are affected?
Versions before 7.2.0 are affected. Version 7.2.0 escapes the attacker-controlled attachment name with htmlspecialchars().
Who can exploit this issue?
An attacker does not need an account on the target system. They need only be able to send a crafted email to a user.
When does the malicious script run?
The script executes in the context of a user who views a crafted multipart/appledouble message. The payload persists in the recipient's mailbox.
Can this vulnerability lead to code execution on its own?
The described flaw executes script in the viewing user's session. The researcher reported reaching an application code-execution path only by chaining it with the arbitrary file-read issue tracked as CVE-2026-58451, including when the viewed message is in an administrator's session.