CVE-2026-58451

Full vulnerability record from the local CVENow database.

Description

Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.

Severity

HIGH

CVSS score

7.1 (v4.0)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-01 19:16:56.690000

Last modified

2026-10-25 16:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-58451",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-01T19:16:56.690",
  "lastModified": "2026-10-25T16:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session."
    },
    {
      "lang": "es",
      "value": "Horde IMP antes de 7.0.1 contiene una vulnerabilidad de salto de ruta en lib/Compose.php que permite a atacantes autenticados leer archivos arbitrarios del sistema de archivos del servidor incrustando secuencias de salto de ruta después de un prefijo de ruta de CKEditor en las URL de img src. Los atacantes pueden eludir la validación de prefijo de stripos() añadiendo secuencias como segmentos de salto de ruta después del prefijo coincidente, haciendo que file_get_contents() lea archivos sensibles cuyo contenido es luego exfiltrado como partes MIME en correos electrónicos salientes; la explotación no autenticada también es posible a través de CSRF contra una sesión autenticada activa."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "horde",
          "product": "imp",
          "defaultStatus": "affected",
          "repo": "https://github.com/horde/imp",
          "packageURL": "pkg:github/horde/imp",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T18:41:12.206279Z",
          "id": "CVE-2026-58451",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://blog.evan.lat/posts/CVE-2026-58451/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/horde/imp/commit/fba972fab72ee6871e5d56e6390bee38593085de",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/horde/imp/pull/85",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/horde/imp/releases/tag/v7.0.1",
      "source": "[email protected]"
    },
    {
      "url": "https://www.horde.org/apps/imp",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/horde-imp-path-traversal-via-compose-php-img-src",
      "source": "[email protected]"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2026/Jul/8",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}