CVE-2026-97735: XSS
ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticketemailparser.php) for email messages that may arrive over SMTP from arbitrary senders.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
ITFlow deployments before 26.08 that use the ticket email parser and accept email messages over SMTP from arbitrary senders are exposed. The affected processing path is cron/ticket_email_parser.php.
What does an attacker need to exploit it?
An attacker does not need prior privileges, but must be able to send an email that reaches the ticket email parser. Exploitation requires user interaction, consistent with the UI:R vector.
Is a default configuration known to be affected?
The available information does not establish whether the affected email-parser behavior is enabled by default. Exposure depends on allowing SVG attachments through the ticket email parser.
What can be done before upgrading?
If an immediate upgrade is not possible, prevent untrusted senders from delivering messages to the ticket email parser and block or remove SVG attachments before they are processed.
How can I determine whether my installation is affected?
Check whether the installed ITFlow version is earlier than 26.08, whether cron/ticket_email_parser.php is used to process incoming ticket email, and whether that mail path can receive SVG attachments from arbitrary SMTP senders.