CVE-2026-97735: ITFlow SVG Attachment XSS Vulnerability

CVE-2026-97735 Overview

CVE-2026-97735 affects ITFlow, an open-source IT documentation and ticketing platform, in versions prior to 26.08. The vulnerability resides in the ticket email parser (cron/ticket_email_parser.php), which accepts Scalable Vector Graphics (SVG) attachments from inbound email messages arriving over Simple Mail Transfer Protocol (SMTP). Because SVG files can embed JavaScript, an attacker controlling the sender address can deliver a malicious attachment that executes script in the context of a ticket viewer's browser session. The flaw is classified as Cross-Site Scripting [CWE-79].

Critical Impact
Unauthenticated remote attackers can deliver SVG-based stored XSS payloads through standard email channels, targeting any helpdesk agent who opens the resulting ticket attachment.

Affected Products

ITFlow versions prior to 26.08
Deployments exposing the ticket email parser cron job to inbound SMTP
ITFlow release 26.07.1 and earlier

Discovery Timeline

2026-09-25 - CVE-2026-97735 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97735

Vulnerability Analysis

ITFlow processes inbound email through a scheduled cron task defined in cron/ticket_email_parser.php. The parser extracts attachments and stores them against the generated ticket. The vulnerable version includes svg in the $allowed_extensions allowlist, letting the parser persist SVG files without sanitization.

SVG is an XML-based image format that supports inline <script> elements and event handlers such as onload. When an agent or client opens the attachment through the ITFlow web interface, the browser renders the SVG and executes any embedded JavaScript in the application's origin. This produces stored Cross-Site Scripting that can hijack sessions, exfiltrate ticket data, or pivot to administrative actions.

Root Cause

The root cause is an overly permissive extension allowlist combined with missing content sanitization for XML-based image types. The parser trusted the file extension and did not strip script-bearing nodes before storing the attachment.

Attack Vector

Exploitation requires network access to the ITFlow SMTP ingestion path and user interaction when a recipient opens the attachment. An attacker sends an email with a crafted SVG attachment to any address monitored by the ITFlow ticket mailbox. The parser creates a ticket, retains the attachment, and the payload fires when a helpdesk user views it.

php

// Patch: remove 'svg' from the allowed attachment extensions in cron/ticket_email_parser.php
// Allowed attachment extensions
-$allowed_extensions = array('jpg', 'jpeg', 'gif', 'png', 'webp', 'svg', 'pdf', 'txt', 'md', 'doc', 'docx', 'csv', 'xls', 'xlsx', 'xlsm', 'zip', 'tar', 'gz');
+$allowed_extensions = array('jpg', 'jpeg', 'gif', 'png', 'webp', 'pdf', 'txt', 'md', 'doc', 'docx', 'csv', 'xls', 'xlsx', 'xlsm', 'zip', 'tar', 'gz');

Source: GitHub Commit 16000efc

Detection Methods for CVE-2026-97735

Indicators of Compromise

SVG attachments stored in ITFlow attachment directories with embedded <script> tags or on* event handlers.
Inbound ticket emails from unknown external senders containing Content-Type: image/svg+xml parts.
Unexpected outbound requests from agent browsers to attacker-controlled hosts shortly after a ticket attachment is opened.

Detection Strategies

Scan the ITFlow uploads directory for files with the .svg extension and inspect them for scripting constructs.
Review inbound mail logs for messages carrying SVG attachments addressed to the ticket mailbox.
Correlate helpdesk session activity with anomalous JavaScript-driven requests originating from the ITFlow origin.

Monitoring Recommendations

Alert on new SVG files written by the ticket_email_parser.php process after upgrading, as none should be created.
Monitor ITFlow web access logs for requests fetching .svg attachments from untrusted sender tickets.
Enable mail gateway rules that quarantine SVG attachments destined for ticketing addresses.

How to Mitigate CVE-2026-97735

Immediate Actions Required

Upgrade ITFlow to version 26.08 or later, which removes svg from the allowed attachment extensions.
Audit existing ticket attachments for stored SVG files and remove any that contain executable content.
Restrict the inbound ticket mailbox to trusted sender domains where operationally feasible.

Patch Information

The fix is delivered in ITFlow 26.08 via commit 16000efc. The change updates cron/ticket_email_parser.php to drop svg from $allowed_extensions and bumps APP_VERSION from 26.07.1 to 26.08. See the GitHub Security Advisory GHSA-89fw-w69c-vghj and the GitHub Commit Details for full change notes.

Workarounds

Manually edit cron/ticket_email_parser.php and remove 'svg' from the $allowed_extensions array if an immediate upgrade is not possible.
Configure a mail transport rule to strip or block image/svg+xml attachments before they reach the ITFlow mailbox.
Serve stored attachments with a Content-Disposition: attachment header and a restrictive Content Security Policy to prevent inline script execution.

bash

# Verify the running ITFlow version and confirm the patch is applied
grep APP_VERSION /path/to/itflow/includes/app_version.php
# Expected output after upgrade:
# DEFINE("APP_VERSION", "26.08");

# Identify any residual SVG attachments ingested before the upgrade
find /path/to/itflow/uploads -type f -iname '*.svg' -print