CVE-2026-112353 Details
Description
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
A stored cross-site scripting vulnerability has been identified in GFI Kerio Connect versions prior to 10.0.8 Patch 2. This vulnerability resides in the Webmail component, where a remote attacker can execute JavaScript in the context of a victim's authenticated Webmail session. The exploitation involves uploading a specially crafted SVG email attachment that evades sanitization of event-handler attributes. Once the attachment is opened, the temporary-download endpoint's inadequate Content-Security-Policy sandbox allows the execution of scripts, potentially leading to the theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has reported observed exploitation of this vulnerability in the wild, where it is used to steal credentials and mailbox data.
Users can upgrade to GFI Kerio Connect version 10.0.8 Patch 2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gfi.ai/resource/kerioconnect-product-releases/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/gfi-kerioconnect-8p2-stored-xss-via-svg-attachment | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GFI KerioConnect | < 10.0.8p2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |