EUVD-2026-86514
GHSA-6phr-xx43-2pr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft SVG with embedded JavaScript
-
DeliveryEmail it as ticket attachment over SMTP
-
ExploitParser stores SVG as allowed attachment
-
ExecutionTechnician opens attachment in browser
-
PersistScript executes in authenticated session
-
ImpactHijack session / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the ITFlow instance run the cron/ticket_email_parser.php email-to-ticket pipeline AND accept inbound SMTP messages from arbitrary/external senders - deployments that do not use email ingestion, or that restrict senders, are not exposed. Exploitation is further gated on a staff user (technician/admin) actually opening the malicious SVG attachment such that it renders inline in the browser (UI:R); it does not fire automatically on ingestion. Affected: ITFlow before 26.08; fixed by removing SVG from the attachment allowlist in 26.08. |
| Impact | This is a genuine, moderately high-priority issue against exposed ITFlow instances, but not an emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N = 8.0) is internally consistent with a stored/cross-context XSS: an unauthenticated remote sender (PR:N) can deliver the payload via email, but exploitation only completes when a staff user opens the malicious SVG (UI:R), and the AC:H reflects that the SVG must actually be rendered inline in the victim's browser rather than downloaded. Scope change (S:C) and C:H/I:H are reasonable for XSS executing in an authenticated technician's session. No EPSS score, no CISA KEV entry, and no public proof-of-concept were provided in the intelligence, so at time of analysis there is no public exploit identified and no evidence of active exploitation. The fix is confirmed and trivially visible in commit 16000ef (removal of 'svg' from the allowed-extension allowlist), which both validates the root cause and lowers exploitation friction for anyone who studies the diff. Net: prioritize patching internet-reachable, SMTP-ingesting ITFlow instances, but the AC:H + UI:R requirements and niche footprint keep this below drop-everything urgency. |
| Exploit ScenarioDerived | An attacker emails a support ticket to an ITFlow instance whose ticket_email_parser cron ingests SMTP mail from arbitrary senders, attaching a crafted .svg file containing embedded JavaScript. The SVG is stored and later rendered inline when a technician or admin opens the ticket attachment in their browser, executing script in their authenticated session (session theft, actions on their behalf). No public POC is referenced, though the one-line fix commit clearly reveals the vulnerable allowlist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Stored cross-site scripting in ITFlow's inbound email-to-ticket parser (cron/ticket_email_parser.php) lets a remote, unauthenticated sender deliver a ticket email carrying a malicious SVG attachment that executes script in the browser of any technician or admin who opens it, running with that staff user's privileges against the ITFlow origin (scope-changed, C:H/I:H). Every ITFlow release before 26.08 is affected, but exposure requires the deployment to actually run the email-ingestion pipeline and to accept inbound SMTP from arbitrary external senders; the payload does not fire on ingestion and needs a staff user to open the attachment (UI:R), which is reflected in the AC:H/UI:R vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and remediation is simple: the vendor-released fix in ITFlow 26.08 removes svg from the attachment allowlist. Given the CVSS 8.0 base score and the privileged session the script inherits, this is a genuine, moderately high-priority issue for exposed instances rather than an emergency.
RemediationAI
Upgrade to ITFlow 26.08, the vendor-released patch version delivered by commit 16000efcf7f7c833aae9f8da22d2a82df21a49c0, which removes 'svg' from the $allowed_extensions array in cron/ticket_email_parser.php; the release details are in the advisory at https://github.com/itflow-org/itflow/security/advisories/GHSA-89fw-w69c-vghj. If upgrading immediately is not possible, backport that single-line change by deleting 'svg' from the allowlist in the affected file, accepting the trade-off that users will no longer be able to attach SVG diagrams or logos to tickets. A stronger short-term containment is to restrict the attack surface rather than the file type: move the cron parser off external inbound SMTP and require mail to arrive only from trusted, authenticated relays or from internal senders via SPF/DKIM/allowlist filtering, or disable the email-to-ticket cron job entirely if the workflow is not needed - the trade-off being lost functionality for mail-driven ticket creation. Because residual risk remains for any SVG that was already stored before patching, consider serving attachments with Content-Disposition: attachment plus a restrictive Content-Security-Policy (for example sandbox and script-src 'none') on the attachment-serving route, keeping in mind that this will break inline preview of images and PDFs for legitimate users. Finally, review existing ticket attachments for uploaded SVG files and remove or quarantine them, and monitor for suspicious script content in stored attachment metadata.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is ITFlow's cron/ticket_email_parser.php, the pipeline that converts inbound mail into tickets and persists MIME attachments to disk. The pre-26.08 allowlist included 'svg' alongside jpg, png, pdf, doc, zip and similar types, and SVG is an XML document format that may legitimately contain <script> elements and event-handler attributes; when such a file is served from the ITFlow origin and rendered inline by a browser, those scripts execute in the application's security context rather than in an isolated image context. That is the classic stored cross-site scripting pattern classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), and it explains the scope-changed S:C rating: the script executes in the technician's authenticated ITFlow session, so it can read and act on ticketing data, client records and administrative functions beyond the attachment-handling code itself. With PR:N the payload can originate from any SMTP sender the instance accepts mail from, while UI:R and AC:H capture the fact that attack success depends on a staff user opening the attachment and on the deployment being configured for email ingestion, making the realistic risk profile deployment-dependent rather than universally critical. The upstream commit 16000efcf7f7c833aae9f8da22d2a82df21a49c0 addresses the root cause by deleting 'svg' from the $allowed_extensions array in that parser and simultaneously bumping APP_VERSION from 26.07.1 to 26.08, confirming that the allowlist entry itself, not the MIME parsing logic, was the defect.
Know when Itflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated email delivery (PR:N) but requires a staff user to open an inline-rendering SVG (UI:R) and depends on browser SVG handling (AC:H); XSS crosses into the victim's session (S:C, C:H/I:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.
Technical POC Analysis
CWE-79 (stored cross-site scripting) in ITFlow's inbound email-to-ticket pipeline, specifically cron/ticketemailparser.php.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
ITFlow helpdesk environments that ingest ticket email from external senders are exposed to stored cross-site scripting through crafted SVG attachments, so a single malicious inbound email can execute attacker-controlled script in the browser session of any technician or administrator who opens it. Because that script runs with the staff member's own privileges against the ITFlow origin, an attacker could read or alter client, asset, and ticketing data while appearing to act as a trusted employee. Leadership should care because the population at risk is privileged IT staff whose accounts hold broad access to the platform, even though the payload requires a staff member to open the attachment and no public exploit or active exploitation was identified at time of analysis.
No vendor-released patch identified at time of analysis per the advisory metadata, so interim mitigations apply: remove svg from the attachment allowlist in the email-to-ticket parser; strip or quarantine SVG and other active-content attachment types at the mail gateway; restrict inbound SMTP to trusted sender domains or disable email-to-ticket ingestion where it is not required; instruct staff not to open SVG attachments on tickets; and monitor stored ticket attachments and web logs for anomalous script execution. The technical description references ITFlow 26.08 as the release that removes svg from the allowlist, so once that version is confirmed available, apply the vendor patch by upgrading all affected instances.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remto
Time-based blind SQL injection in ITFlow versions prior to 26.07 allows an authenticated user who holds module_support w
SQL injection in ITFlow versions prior to 26.07 allows an authenticated user with the Technician role or higher who has
Insecure Direct Object Reference (IDOR) in ITFlow allows a low-privileged authenticated agent to exfiltrate plaintext cr
An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a pro
Exploit-DB