Stored Cross-Site Scripting in GFI KerioConnect Webmail Component
CVE-2026-112353

6.2MEDIUM

Key Information:

Vendor

Gfi Usa, Llc

Status
Gfi Kerioconnect
Vendor
CVE Published:
27 October 2026

What is CVE-2026-112353?

GFI KerioConnect prior to version 10.0.8 Patch 2 includes a vulnerability within its Webmail component that permits remote attackers to execute JavaScript in an authenticated user's session. This is achievable by delivering a specially crafted SVG email attachment that navigates around sanitization protocols, specifically targeting event-handler attributes. Exploitation occurs through a flaw in the temporary-download endpoint's Content-Security-Policy sandbox, enabling attackers to run scripts once the attachment is activated by the user. This can lead to unauthorized access to sensitive information such as user credentials and mailbox contents, posing a significant threat to impacted users.

Affected Version(s)

GFI KerioConnect 0 < 10.0.8p2

References

https://gfi.ai/resource/kerioconnect-product-releases/
release-notespatch
https://www.vulncheck.com/advisories/gfi-kerioconnect-8p2...
third-party-advisory

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Proofpoint Threat Research — Stu Del Caliz and Greg Lesnewich
.