CVE-2026-97735

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97735
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97735.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97735
Aliases
  • GHSA-89fw-w69c-vghj
Published
2026-09-25T03:45:03Z
Modified
2026-10-28T02:30:23Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97735.json"
}
References

Affected packages

Git / github.com/itflow-org/itflow

Affected ranges

Type
GIT
Repo
https://github.com/itflow-org/itflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ccaa45b0ae9900ad731a6491559f65ff8d87a8f3
Fixed
16000efcf7f7c833aae9f8da22d2a82df21a49c0
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "26.08"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "16000efcf7f7c833aae9f8da22d2a82df21a49c0"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v25.*
v25.01
v25.01.2
v25.01.3
v25.02
v25.02.1
v25.02.2
v25.02.3
v25.02.4
v25.03
v25.05
v25.06
v25.09
v25.10
v25.11
v25.12
v26.*
v26.02
v26.04
v26.05
v26.07
v26.3
v26.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97735.json"