CVE-2026-58451: Horde IMP Path Traversal & Arbitrary File Read Vulnerability

Technical summary

The vulnerability exists in lib/Compose.php where user-controlled input from CKEditor image source (img src) URLs is validated using a simple stripos() prefix check. An attacker can bypass this shallow validation by embedding path traversal sequences (such as ../ or absolute paths) after the expected prefix, which the prefix check does not account for. The crafted URL is then passed to file_get_contents(), which interprets the traversal sequences and reads arbitrary files from the filesystem. The file contents are subsequently embedded into MIME-encoded email messages and exfiltrated. The CSRF vector broadens the attack surface by allowing unauthenticated attackers to trigger this behavior against authenticated sessions without direct credentials.

Business impact

Compromise of sensitive files stored on servers running Horde IMP could expose customer data, application configuration files, database credentials, API keys, or other proprietary information. If confidential files are read and sent via email, data exfiltration occurs with a clear audit trail in email logs. For organizations using Horde IMP for webmail or collaboration, this represents a material confidentiality breach. The CSRF variant amplifies risk because legitimate users become vectors for attack without their knowledge.

Affected systems

Horde IMP versions prior to 7.0.1 are affected. The vulnerability requires either an authenticated user account or an active session that can be targeted via CSRF. Any deployment of vulnerable Horde IMP versions accessible over a network is at risk if users are actively authenticated.

Exploitability

The vulnerability is relatively straightforward to exploit for an authenticated attacker—it requires only crafting a specially formatted image URL within an email compose action. The prefix validation weakness is not complex to bypass with basic path traversal knowledge. The CSRF variant removes the authentication requirement but introduces UI/social engineering complexity (user must click a malicious link while authenticated). No special network access, timing, or brute-force is needed. CVSS reflects this as a 6.5 MEDIUM score: network-accessible, low complexity, but requires authentication or CSRF preconditions.

Remediation

Upgrade Horde IMP to version 7.0.1 or later. This patch version corrects the prefix validation logic to properly reject or sanitize path traversal sequences before passing input to file operations. Verify the specific patch version against the official Horde project advisory before deployment.

Patch guidance

Administrators should prioritize upgrading to Horde IMP 7.0.1 or newer. Before patching, inventory instances of Horde IMP in your environment and verify their current versions (check the VERSION file or administration interface). Apply patches in a maintenance window to avoid service disruption. Test the upgrade in a non-production environment first to ensure compatibility with any local customizations. Once patched, no further configuration changes are required.

Detection guidance

Monitor access logs and email server logs for unusual patterns: look for composed emails with img src URLs containing path traversal sequences (../, absolute paths, or URL-encoded variants like %2e%2e%2f). Examine MIME-encoded email content for unexpected file contents or repeated references to sensitive file paths (/etc/passwd, configuration files, etc.). Network detection: watch for POST requests to compose endpoints with suspicious URL parameters. Log authentication events and cross-reference with CSRF-style attack patterns (requests from external referrers or missing referrer headers during sensitive operations). Alert on file_get_contents() errors in application logs that reference unauthorized paths.

Why prioritize this

Although rated MEDIUM (6.5 CVSS), this vulnerability warrants prompt patching because confidentiality impact is HIGH and the attack is easily exploitable once an attacker has credentials or can social-engineer an authenticated user. Data exfiltration via email is difficult to detect in real-time and can result in regulatory exposure (GDPR, HIPAA, etc.) if personal or regulated data is accessed. The CSRF vector particularly elevates practical risk for webmail deployments. Organizations should treat this with similar urgency to HIGH-severity issues if Horde IMP processes sensitive information.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: Network-accessible (AV:N), Low Attack Complexity (AC:L), Login Required (PR:L), No User Interaction after initial setup (UI:N), Confidentiality Impact High (C:H), Integrity and Availability unaffected (I:N, A:N). The score does not weight the CSRF variant separately, but the underlying path traversal and file exfiltration mechanism is fundamentally a confidentiality breach with no complexity. The MEDIUM label may understate practical risk for organizations storing highly sensitive data; apply your own risk context.

Frequently asked questions