CVE-2026-8496: Alinto SOGo XSS Vulnerability

CVE-2026-8496 Overview

CVE-2026-8496 is a cross-site scripting (XSS) vulnerability in Alinto SOGo version 5.12.7. The flaw exists in how the webmail interface renders Scalable Vector Graphics (SVG) content embedded in the description field of iCalendar (ICS) invitation files. An attacker crafts an ICS invitation containing SVG markup with an onrepeat event handler, which SOGo fails to sanitize before rendering. When an authenticated user views the malicious invite, arbitrary JavaScript executes in their browser session.

Critical Impact

Successful exploitation allows mailbox access, theft of email and contact data, session hijacking, and any action the authenticated SOGo user can perform.

Affected Products

• Alinto SOGo version 5.12.7
• SOGo webmail interface processing ICS calendar invitations
• Earlier SOGo releases sharing the same ICS rendering logic

Discovery Timeline

• 2026-05-13 - CVE-2026-8496 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database
• SOGo 5.12.8 - Alinto releases patched version addressing the issue

Technical Details for CVE-2026-8496

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw triggered through ICS calendar invitation files. SOGo accepts ICS files as legitimate calendar content and parses the DESCRIPTION property for display in the webmail interface. The description field permits HTML rendering, and SOGo's sanitizer fails to strip embedded SVG elements containing event handlers such as onrepeat.

When the recipient opens the calendar invitation, the browser parses the SVG payload and fires the event handler, executing attacker-controlled JavaScript within the SOGo origin. Because the script runs inside the authenticated session, it inherits the user's privileges. Attack scope changes from the attacker to the victim's session, which raises the impact beyond a simple reflected XSS.

Root Cause

The root cause is insufficient HTML sanitization of ICS DESCRIPTION content prior to rendering. SOGo's sanitizer strips well-known script vectors but does not account for SVG-specific animation event handlers like onrepeat, onbegin, and onend. These handlers fire automatically when associated SVG animation elements activate, requiring no user click or focus event.

Attack Vector

An attacker emails a crafted ICS invitation to a SOGo user. The ICS file embeds SVG markup with an animated element and an onrepeat handler containing JavaScript. When the victim opens the invitation in the webmail interface, the payload executes in the SOGo origin. The attacker can then exfiltrate mail contents, contacts, and session tokens, or issue authenticated requests on the victim's behalf. Refer to the GitHub commit fixing the issue for the specific sanitization changes.

Detection Methods for CVE-2026-8496

Indicators of Compromise

• Inbound email messages containing ICS attachments with SVG markup or <animate> elements inside the DESCRIPTION property
• ICS files referencing event handler attributes including onrepeat, onbegin, onend, or onload
• Unexpected outbound HTTP requests from user browsers to attacker-controlled domains shortly after a calendar invite is opened
• Anomalous SOGo API calls listing mailbox folders, exporting contacts, or forwarding messages within a single short session

Detection Strategies

• Inspect ICS attachments at the mail gateway for SVG tags, animation elements, and inline event handlers in calendar fields
• Enable Content Security Policy reporting on the SOGo origin to capture inline script execution attempts
• Correlate webmail session telemetry with browser-initiated requests to uncommon external hosts following invite views
• Review SOGo access logs for bulk read operations, mass message forwarding, or contact exports immediately after ICS rendering

Monitoring Recommendations

• Alert on ICS files where the DESCRIPTION property contains <svg, <animate, or on[a-z]+= patterns
• Track session activity per user and flag deviations such as rapid mailbox enumeration after calendar interaction
• Monitor browser console errors and CSP violations reported from authenticated SOGo sessions

How to Mitigate CVE-2026-8496

Immediate Actions Required

• Upgrade SOGo to version 5.12.8 or later, which includes the sanitization fix from commit 67ce01e
• Restrict ICS attachments at the mail gateway until the patched version is deployed across all SOGo instances
• Notify users to avoid opening unexpected calendar invitations from unknown senders

Patch Information

Alinto released SOGo 5.12.8 containing the corrective sanitization logic. Review the SOGo 5.12.8 release notes and the SOGo announcement for the full change list. The upstream fix is published in the Alinto/sogo commit 67ce01e.

Workarounds

• Apply a strict Content Security Policy on the SOGo virtual host that disallows inline scripts and restricts SVG sources
• Strip or quarantine ICS attachments containing <svg> or animation event handlers at the email gateway
• Disable HTML rendering of calendar descriptions in SOGo configuration where the option is available

# Example: block ICS attachments containing SVG event handlers at a Postfix/Amavis gateway
# /etc/amavis/conf.d/50-user
$banned_filename_re = new_RE(
  qr'\.ics$'i,                       # quarantine all ICS for inspection
  qr'(?i)<svg[^>]*onrepeat\s*='m,    # block ICS with onrepeat handlers
  qr'(?i)<animate[^>]*>'m,           # block SVG animation in calendar bodies
);