PT-2026-54913 · Horde Imp · Horde Imp

Evan + 1 · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-58451

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 7.0.1

Description A path traversal issue exists in the lib/Compose.php file. Authenticated attackers can read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. This occurs because the stripos() prefix validation can be bypassed by appending traversal segments, leading the file get contents() function to read sensitive files. The contents of these files are then exfiltrated as MIME parts in outgoing emails. Additionally, unauthenticated exploitation is possible through Cross-Site Request Forgery (CSRF), which is a technique used to trick a victim's browser into performing an unwanted action on a different website where the victim is currently authenticated.

Recommendations Update Horde IMP to version 7.0.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-58451

Affected Products

Horde Imp

References · 10

• 🔥 https://blog.evan.lat/posts/CVE-2026-58451 · Exploit
• https://github.com/horde/imp/commit/fba972fab72ee6871e5d56e6390bee38593085de · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58451 · Security Note
• https://github.com/horde/imp/pull/85 · Note
• https://github.com/horde/imp/releases/tag/v7.0.1 · Note
• https://t.me/cveNotify/185556 · Telegram Post
• https://horde.org/apps/imp · Note
• http://seclists.org/fulldisclosure/2026/Jul/8 · Note
• https://vulncheck.com/advisories/horde-imp-path-traversal-via-compose-php-img-src · Note
• https://t.me/CVEtracker/58604 · Telegram Post