Horde IMP CVE-2026-58451

Exploitation requires the message-compose flow of Horde IMP with CKEditor-based HTML/inline-image handling, where an img src URL must first match the expected CKEditor path prefix (to pass the stripos() check) and then carry appended directory-traversal segments referencing the target file. The primary path requires a low-privilege authenticated webmail session (PR:L); the described alternative removes the credential requirement by using CSRF, which instead requires an already-authenticated victim to be induced into submitting the crafted compose request. Limiting factors: the target file must be readable by the web server/PHP process, output is confined to file contents disclosed via outgoing email (read-only, no write/execution), and the CSRF variant depends on an active victim session plus successful request forgery (absent or weak anti-CSRF controls).

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, score 7.1) describes network-reachable, low-complexity exploitation requiring only low-privilege authentication, yielding high confidentiality impact with no integrity or availability impact - consistent with an arbitrary file-read primitive. That matches the description: any valid webmail user can read server files. The description additionally claims an unauthenticated variant via CSRF against an active session, which the base vector's PR:L does not fully capture - the CSRF path shifts the requirement from attacker credentials to a socially-engineered request against a logged-in victim (effectively UI:R/PR:N-flavored), so real-world reachability may be broader than PR:L implies. No EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation; risk is currently driven by disclosure quality (VulnCheck advisory) rather than observed attacks. Net: a genuine, credible file-disclosure issue worth prompt patching for exposed Horde instances, but not an emergency without exploitation signals - treat as high-priority-for-exposed-webmail, not drop-everything.

An authenticated Horde IMP user (or an attacker who tricks a logged-in user into submitting a crafted request via CSRF) composes a message containing an inline image whose src URL begins with the expected CKEditor prefix but appends traversal sequences pointing at a sensitive file. When IMP processes the compose action, stripos() accepts the prefix and file_get_contents() reads the targeted file, attaching its contents as a MIME part on the outgoing email - so the attacker simply mails the file to themselves. No public exploit code was identified, but the technique is straightforward given the published advisory detail.