Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-65053

CVE-2026-65053MEDIUM

Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   A   L   L   N    5.1   .0041   33.1     —

AFFECTED
  Product  Versions     Fixed
  imp      unspecified  —

TIMELINE
  Jul 21  Reserved by VulnCheck
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-65053 (horde imp). Public exploit reference added.
  Aug 24  Published (CNA: VulnCheck)
  Aug 26  EXPLOIT PUBLISHED — CVE-2026-65053 (horde imp). Public exploit reference added.
  Aug 29  EXPLOIT PUBLISHED — CVE-2026-65053 (horde imp). Public exploit reference added.

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 7 references · NVD status: Deferred

Description

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
July 21, 2026	Reserved	Reserved by VulnCheck
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-65053 (horde imp). Public exploit reference added.
August 24, 2026	Published	Published (CNA: VulnCheck)
August 26, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-65053 (horde imp). Public exploit reference added.
August 29, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-65053 (horde imp). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
horde	imp	—	—	—

Weaknesses

CWE-79

References (7)

Authoritative record: CVE-2026-65053 at cve.org

Vendors: horde

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-65053 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.