Which versions of Horde IMP are affected by CVE-2026-58451?

Horde IMP webmail prior to version 7.0.1 contains a file-disclosure vulnerability enabling attackers to extract sensitive data (credentials, configuration files) from internet-facing installations…. A patch is available.

How to fix or mitigate CVE-2026-58451?

Within 24 hours: Identify and catalog all internet-accessible Horde IMP deployments; assess current version and user count. Within 7 days: Deploy patch to version 7.0.1 across all instances. Within 30 days: Audit webmail activity logs for abnormal attachment activity; rotate administrative credentials and database passwords if stored in web-accessible configuration.

Horde IMP CVE-2026-58451

Q: What is the CVSS score of CVE-2026-58451?

CVE-2026-58451 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41111 HIGH

Path Traversal (CWE-22)

2026-07-01 VulnCheck

GHSA-mv7w-qwqh-w2g9

PHP Path Traversal CSRF Imp Horde

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable compose action needs a low-privilege authenticated session (PR:L) with no special complexity; primitive discloses arbitrary files (C:H) but cannot modify or disrupt (I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:52 vuln.today

DescriptionCVE.org

Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.

AnalysisAI

Arbitrary file disclosure in Horde IMP webmail before 7.0.1 lets an authenticated user read any file the web server can access by planting directory-traversal sequences after a CKEditor path prefix inside an image src URL when composing mail. A weak stripos() prefix check fails to block traversal appended after the allowed prefix, so file_get_contents() pulls in files like /etc/passwd or configuration secrets and attaches them as MIME parts on the outgoing message. No public exploit identified at time of analysis, but VulnCheck published an advisory and the flaw is CSRF-triggerable against a live session, raising practical exposure for internet-facing Horde deployments.

Technical ContextAI

Horde IMP is the IMAP webmail application of the PHP-based Horde Groupware suite (CPE cpe:2.3:a:horde:imp). The vulnerable code path is in lib/Compose.php, which processes inline images referenced by img src URLs. To distinguish legitimate CKEditor-hosted assets from external content, it validates the URL with a case-insensitive substring prefix check (stripos()) and then loads the referenced path with file_get_contents(). Because stripos() only confirms the expected CKEditor prefix appears in the string - it does not anchor or canonicalize the remaining path - an attacker can satisfy the prefix and then append '../' traversal segments, defeating the intended allowlist. This is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory: the root cause is trusting a substring match instead of resolving the final path and confirming it stays within an intended base directory.

RemediationAI

Upgrade to Horde IMP 7.0.1, which contains the fix (Vendor-released patch: 7.0.1) via commit fba972fab72ee6871e5d56e6390bee38593085de and PR #85 - see https://github.com/horde/imp/releases/tag/v7.0.1 and https://www.vulncheck.com/advisories/horde-imp-path-traversal-via-compose-php-img-src. If immediate patching is not possible, reduce exposure by restricting the webmail to trusted networks/VPN and enforcing anti-CSRF protections to blunt the session-riding vector, tightening the web server/PHP account's filesystem permissions (e.g. open_basedir, least-privilege runtime user) so file_get_contents() cannot reach sensitive paths like /etc or Horde config files - noting this narrows but does not eliminate the read primitive - and, where feasible, disabling inline-image/HTML composition in CKEditor to remove the vulnerable img-src handling, at the cost of losing rich-text and embedded-image functionality for users.