UBUNTU-CVE-2026-65053

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-65053
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65053.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-65053
Upstream
Published
2026-08-24T15:16:00Z
Modified
2026-09-02T19:35:34Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

References

Affected packages

Ubuntu:16.04:LTS / php-horde-imp

Package

Name
php-horde-imp
Purl
pkg:deb/ubuntu/php-horde-imp?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.2.10-1
6.2.11-1
6.2.12-1
6.2.12-1ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "php-horde-imp",
            "binary_version": "6.2.12-1ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65053.json"

Ubuntu:18.04:LTS / php-horde-imp

Package

Name
php-horde-imp
Purl
pkg:deb/ubuntu/php-horde-imp?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.2.20-1
6.2.21-1
6.2.21-1ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "php-horde-imp",
            "binary_version": "6.2.21-1ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65053.json"