Stored Cross-Site Scripting in Horde IMP AppleDouble MIME Viewer
CVE-2026-65053

5.1MEDIUM

Key Information:

Vendor: Horde
Status: Imp
Vendor: CVE Published:; 24 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-65053?

The Horde IMP AppleDouble MIME viewer is vulnerable to stored cross-site scripting due to improper handling of attachment names. An attacker can craft a multipart/appledouble message with an unsafe name parameter that gets rendered without escaping in the HTML output. This allows scripts to execute in the browser context of any user who views the email, with the potential for significant security implications. Exploitation of this vulnerability does not require an account on the target system, merely the ability to send an email to an unsuspecting user. To mitigate this issue, it is advisable to update to Horde IMP version 7.2.0 or later, which implements proper escaping measures.

Affected Version(s)

imp 0 < 7.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-65053 - Proof of Concept