Cross-Site Scripting Vulnerability in GFI KerioConnect Webmail

CVE-2026-112356

What is CVE-2026-112356?

GFI KerioConnect prior to version 10.0.9 Patch 2 is vulnerable to cross-site scripting (XSS) attacks within its Webmail component. Attackers can exploit this vulnerability by sending specially crafted emails containing links. The malicious emails take advantage of the link auto-formatter feature, which can inadvertently allow the injection of HTML and scripts into the victim’s Webmail session. This occurs through the manipulation of quote characters that break out of the href attribute in the email's HTML, thereby executing unintended scripts under the affected user's session.

References