CVE-2026-65053: Horde IMP AppleDouble XSS Vulnerability

CVE-2026-65053 Overview

CVE-2026-65053 is a stored cross-site scripting (XSS) vulnerability in the Horde IMP webmail application. The AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. An attacker triggers the flaw by sending an email crafted as multipart/appledouble with markup embedded in the data part's name parameter. When any recipient opens the message in IMP, the payload executes in their browser session and persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Horde IMP version 7.2.0 remediates the flaw by escaping the value with htmlspecialchars().

Critical Impact
Script executed in an administrator's IMP session can be chained with the arbitrary file read in CVE-2026-58451 to reach an application code-execution path.

Affected Products

Horde IMP webmail client versions prior to 7.2.0
Deployments exposing the AppleDouble MIME viewer (lib/Mime/Viewer/Appledouble.php)
Horde Groupware installations bundling the vulnerable IMP release

Discovery Timeline

2026-08-24 - CVE-2026-65053 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65053

Vulnerability Analysis

The flaw resides in lib/Mime/Viewer/Appledouble.php within the _IMPrender() method. The method retrieves the data part name using IMP_Contents::getPartName(), which returns the MIME part's name parameter as supplied by the message sender. That value is passed through sprintf into the text of an IMP_Mime_Status object.

IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup. The attacker-controlled string reaches the rendered page verbatim, so HTML and script tags in the name parameter are executed in the viewer's browser context. This maps to Improper Neutralization of Input During Web Page Generation [CWE-79].

Root Cause

The viewer trusts a MIME parameter that is fully attacker-controlled and never applies output encoding before assembling HTML. The fix wraps $data_name with htmlspecialchars($data_name, ENT_QUOTES, $charset) before it enters the status block template.

Attack Vector

An unauthenticated remote attacker sends an email to any IMP user. The message is structured as multipart/appledouble, and the data sub-part carries an HTML or JavaScript payload inside its name parameter. When the recipient opens the message, the payload persists in the mailbox and re-executes on every view. If the recipient is an administrator, the researcher reports the XSS can be chained with the arbitrary file read in CVE-2026-58451 to reach application code execution.

php

$data_name = $this->getConfigParam('imp_contents')->getPartName($data_part);

$status = new IMP_Mime_Status($this->_mimepart, [
-    sprintf(_('This message contains a Macintosh file (named "%s").'), $data_name),
+    sprintf(_('This message contains a Macintosh file (named "%s").'), htmlspecialchars($data_name, ENT_QUOTES, $this->getConfigParam('charset'))),
     $this->getConfigParam('imp_contents')->linkViewJS(
         $applefile_part,
         'download_attach',

Source: GitHub commit f31449a1 — the patch applies htmlspecialchars() with ENT_QUOTES to the attachment name before it is interpolated into the status block.

Detection Methods for CVE-2026-65053

Indicators of Compromise

Inbound messages with Content-Type: multipart/appledouble whose data sub-part name parameter contains angle brackets, quotes, or script, img, svg, or on* event handler substrings.
Stored mailbox items whose MIME headers contain HTML entities or raw tags in the name= parameter of an AppleDouble data part.
Outbound HTTP requests from webmail sessions to unfamiliar hosts immediately after a user opens a Macintosh file attachment notice.

Detection Strategies

Parse inbound SMTP or IMAP traffic for multipart/appledouble parts and flag name parameters that contain HTML metacharacters.
Instrument the IMP web tier to log rendered IMP_Mime_Status output and alert when status text contains unescaped tag characters.
Correlate mailbox scans with administrator sessions that subsequently request unexpected file paths, which may indicate chaining with CVE-2026-58451.

Monitoring Recommendations

Enforce a Content Security Policy on the IMP host and monitor CSP violation reports for inline script blocks originating from message-rendering routes.
Track access logs for message-view URLs immediately followed by administrative actions from the same session ID.
Alert on any modification to lib/Mime/Viewer/Appledouble.php that reverts the htmlspecialchars() call.

How to Mitigate CVE-2026-65053

Immediate Actions Required

Upgrade Horde IMP to version 7.2.0 or later, which applies htmlspecialchars() to the AppleDouble part name.
Audit mailboxes for stored multipart/appledouble messages containing markup in the name parameter and quarantine them before users open them.
Rotate credentials and session tokens for administrator accounts that may have opened untrusted AppleDouble messages, given the chaining path to CVE-2026-58451.

Patch Information

Apply the fix from Horde IMP release v7.2.0 or merge the change from pull request #107 and commit f31449a1. Additional analysis is available in the VulnCheck advisory and the researcher write-up.

Workarounds

Disable the AppleDouble MIME viewer in the IMP MIME configuration until the patched version can be deployed.
Add a mail gateway rule that strips or rewrites name parameters containing HTML metacharacters on inbound multipart/appledouble messages.
Deploy a strict Content Security Policy on the IMP web host to block inline script execution as a defense-in-depth control.

bash

# Upgrade Horde IMP via PEAR to the fixed release
pear upgrade horde/Horde_Imp-7.2.0

# Verify the patched call is present in the deployed source
grep -n 'htmlspecialchars($data_name' /var/www/horde/imp/lib/Mime/Viewer/Appledouble.php