Skip to content
OpenAdvisories

Package · Debian

php-horde-imp

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-65053

    Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

    Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns…

    horde imp php-horde-imp php-horde-imp Debian Ubuntu
  • Medium 6.5
    CVE-2026-58451

    Horde IMP < 7.0.1 Path Traversal via Compose.php img src

    Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers c…

    horde imp php-horde-imp php-horde-imp Debian Ubuntu