CVE-2026-65053

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 7.2.0

Description The AppleDouble MIME viewer fails to escape attachment names written into an HTML status block. In the file lib/Mime/Viewer/Appledouble.php, the IMPrender() function uses IMP Contents::getPartName() to retrieve the MIME part name provided in the message and passes it via sprintf into an IMP Mime Status object. Because IMP Mime Status:: toString() concatenates text entries directly into table markup, the value is rendered verbatim. An attacker can send a crafted multipart/appledouble message containing markup in the name parameter to execute scripts in the context of any user who views the email, with the payload persisting in the mailbox. This does not require an account on the target system. If executed in an administrator session, this can be chained with an arbitrary file read to achieve application code execution.

Recommendations Update to version 7.2.0.