CVE-2025-41066

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-41066
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41066.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-41066
Downstream
Published
2025-12-02T14:01:34.192Z
Modified
2026-07-15T01:48:56.493734075Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Disclosure of sensitive information in Horde Groupware
Details

Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41066.json",
    "cwe_ids": [
        "CWE-200"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.2.22"
                },
                {
                    "last_affected": "5.2.22"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "INCIBE"
}
References

Affected packages

Git / github.com/horde/groupware

Affected ranges

Type
GIT
Repo
https://github.com/horde/groupware
Events
Introduced
cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70
Last affected
cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70
Database specific 
{
    "extracted_events": [
        {
            "introduced": "5.2.22"
        },
        {
            "last_affected": "5.2.22"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:horde:groupware:5.2.22:*:*:*:-:*:*:*"
}

Affected versions

5.*
5.2.22
v5.*
v5.2.22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41066.json"

Git / github.com/horde/horde

Affected ranges

Type
GIT
Repo
https://github.com/horde/horde
Events
Introduced
da4d701808c3af4100bd1f2d7f0fd07854267fa9
Last affected
da4d701808c3af4100bd1f2d7f0fd07854267fa9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "5.2.22"
        },
        {
            "last_affected": "5.2.22"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:horde:groupware:5.2.22:*:*:*:-:*:*:*"
}

Affected versions

5.*
5.2.22
webmail-5.*
webmail-5.2.22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41066.json"